← Back to scan
File as GitHub Issue repo: libnyanpasu/clash-nyanpasu

Push this scan report to libnyanpasu/clash-nyanpasu

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

JS: child_process.exec with non-literal

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
HIGH SEC083 [SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) — variable input can c… scripts/manifest.ts:69
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… frontend/nyanpasu/src/pages/(main)/_mod…:37
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… frontend/nyanpasu/src/utils/custom-css-…:244
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… frontend/nyanpasu/src/pages/(editor)/ed…:132
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… frontend/nyanpasu/src/pages/(editor)/ed…:69
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … frontend/interface/src/provider/mutatio…:57
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … frontend/interface/src/hooks/use-kv-sto…:119
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … backend/tauri/src/utils/hwid.rs:132
HIGH MINED041 [MINED041] Rust Unimplemented Macro: unimplemented!() panics. Same as todo!() but convent… backend/tauri/src/enhance/script/runner…:45
HIGH MINED041 [MINED041] Rust Unimplemented Macro: unimplemented!() panics. Same as todo!() but convent… backend/tauri/src/core/tasks/executor.rs:80
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… backend/tauri/src/core/pac.rs:293
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… backend/tauri/src/core/download/adapter…:148
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… backend/tauri/src/config/profile/tests.…:240
HIGH MINED003 [MINED003] Rust Unwrap In Prod: .unwrap() panics if None/Err. Acceptable in tests; risky … backend/nyanpasu-core/src/state/manager…:139
HIGH MINED003 [MINED003] Rust Unwrap In Prod: .unwrap() panics if None/Err. Acceptable in tests; risky … backend/boa_utils/src/module/http.rs:203
HIGH MINED003 [MINED003] Rust Unwrap In Prod: .unwrap() panics if None/Err. Acceptable in tests; risky … backend/boa_utils/src/console/tests.rs:9
HIGH MINED115 Action `actions/cache` pinned to mutable ref `@v5` .github/workflows/deps-build-linux.yaml:100
HIGH MINED115 Action `denoland/setup-deno` pinned to mutable ref `@v2` .github/workflows/deps-build-linux.yaml:91
HIGH MINED115 Action `pnpm/action-setup` pinned to mutable ref `@v6` .github/workflows/deps-build-linux.yaml:86
HIGH MINED115 Action `actions/setup-node` pinned to mutable ref `@v6` .github/workflows/deps-build-linux.yaml:83
HIGH MINED115 Action `cargo-bins/cargo-binstall` pinned to mutable ref `@main` .github/workflows/deps-build-linux.yaml:59
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/deps-build-linux.yaml:50
HIGH MINED115 Action `actions/download-artifact` pinned to mutable ref `@v8` .github/workflows/deps-message-telegram…:50
HIGH MINED115 Action `denoland/setup-deno` pinned to mutable ref `@v2` .github/workflows/deps-message-telegram…:43
HIGH MINED115 Action `actions/setup-node` pinned to mutable ref `@v6` .github/workflows/deps-message-telegram…:39
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/deps-message-telegram…:38
HIGH MINED115 Action `mknejp/delete-release-assets` pinned to mutable ref `@v1` .github/workflows/deps-delete-releases.…:27
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/deps-delete-releases.…:24
HIGH MINED115 Action `actions/download-artifact` pinned to mutable ref `@v8` .github/workflows/deps-upload-release-a…:22
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/deps-upload-release-a…:19
HIGH MINED115 Action `softprops/action-gh-release` pinned to mutable ref `@v3` backend/tauri-plugin-deep-link/.github/…:31
HIGH MINED115 Action `orhun/git-cliff-action` pinned to mutable ref `@v4` backend/tauri-plugin-deep-link/.github/…:24
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` backend/tauri-plugin-deep-link/.github/…:14
HIGH MINED115 Action `Swatinem/rust-cache` pinned to mutable ref `@v2` backend/tauri-plugin-deep-link/.github/…:23
HIGH MINED115 Action `dtolnay/rust-toolchain` pinned to mutable ref `@stable` backend/tauri-plugin-deep-link/.github/…:20
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` backend/tauri-plugin-deep-link/.github/…:19
HIGH MINED115 Action `actions-rs/audit-check` pinned to mutable ref `@v1` backend/tauri-plugin-deep-link/.github/…:24
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` backend/tauri-plugin-deep-link/.github/…:23
HIGH MINED115 Action `Swatinem/rust-cache` pinned to mutable ref `@v2` backend/tauri-plugin-deep-link/.github/…:26
HIGH GHSA-ph9p-34f9-6g65 tmp: GHSA-ph9p-34f9-6g65 pnpm-lock.yaml
HIGH GHSA-c2c7-rcm5-vvqj picomatch: GHSA-c2c7-rcm5-vvqj pnpm-lock.yaml
HIGH GHSA-7r86-cg39-jmmj minimatch: GHSA-7r86-cg39-jmmj pnpm-lock.yaml
HIGH GHSA-3ppc-4f35-3m26 minimatch: GHSA-3ppc-4f35-3m26 pnpm-lock.yaml
HIGH GHSA-23c5-xmqv-rm74 minimatch: GHSA-23c5-xmqv-rm74 pnpm-lock.yaml
HIGH GHSA-pv5w-4p9q-p3v2 kysely: GHSA-pv5w-4p9q-p3v2 pnpm-lock.yaml
HIGH GHSA-qjx8-664m-686j js-cookie: GHSA-qjx8-664m-686j pnpm-lock.yaml
HIGH GHSA-v39h-62p7-jpjc fast-uri: GHSA-v39h-62p7-jpjc pnpm-lock.yaml
HIGH GHSA-q3j6-qgpj-74h6 fast-uri: GHSA-q3j6-qgpj-74h6 pnpm-lock.yaml
HIGH RUSTSEC-2026-0104 rustls-webpki: RUSTSEC-2026-0104 backend/nyanpasu-egui/Cargo.lock
HIGH RUSTSEC-2026-0099 rustls-webpki: RUSTSEC-2026-0099 backend/nyanpasu-egui/Cargo.lock
HIGH RUSTSEC-2026-0098 rustls-webpki: RUSTSEC-2026-0098 backend/nyanpasu-egui/Cargo.lock
HIGH RUSTSEC-2026-0049 rustls-webpki: RUSTSEC-2026-0049 backend/nyanpasu-egui/Cargo.lock
HIGH RUSTSEC-2024-0399 rustls: RUSTSEC-2024-0399 backend/nyanpasu-egui/Cargo.lock
HIGH RUSTSEC-2025-0009 ring: RUSTSEC-2025-0009 backend/nyanpasu-egui/Cargo.lock
HIGH RUSTSEC-2026-0097 rand: RUSTSEC-2026-0097 backend/nyanpasu-egui/Cargo.lock
HIGH RUSTSEC-2024-0436 paste: RUSTSEC-2024-0436 backend/nyanpasu-egui/Cargo.lock
HIGH RUSTSEC-2024-0421 idna: RUSTSEC-2024-0421 backend/nyanpasu-egui/Cargo.lock
HIGH RUSTSEC-2024-0402 hashbrown: RUSTSEC-2024-0402 backend/nyanpasu-egui/Cargo.lock
HIGH RUSTSEC-2026-0007 bytes: RUSTSEC-2026-0007 backend/nyanpasu-egui/Cargo.lock
HIGH RUSTSEC-2025-0056 adler: RUSTSEC-2025-0056 backend/nyanpasu-egui/Cargo.lock
HIGH RUSTSEC-2025-0098 unic-ucd-version: RUSTSEC-2025-0098 backend/Cargo.lock
HIGH RUSTSEC-2025-0100 unic-ucd-ident: RUSTSEC-2025-0100 backend/Cargo.lock
HIGH RUSTSEC-2025-0080 unic-common: RUSTSEC-2025-0080 backend/Cargo.lock
HIGH RUSTSEC-2025-0075 unic-char-range: RUSTSEC-2025-0075 backend/Cargo.lock
HIGH RUSTSEC-2025-0081 unic-char-property: RUSTSEC-2025-0081 backend/Cargo.lock
HIGH RUSTSEC-2026-0103 thin-vec: RUSTSEC-2026-0103 backend/Cargo.lock
HIGH RUSTSEC-2026-0068 tar: RUSTSEC-2026-0068 backend/Cargo.lock
HIGH RUSTSEC-2026-0067 tar: RUSTSEC-2026-0067 backend/Cargo.lock
HIGH RUSTSEC-2026-0104 rustls-webpki: RUSTSEC-2026-0104 backend/Cargo.lock
HIGH RUSTSEC-2026-0099 rustls-webpki: RUSTSEC-2026-0099 backend/Cargo.lock
HIGH RUSTSEC-2026-0098 rustls-webpki: RUSTSEC-2026-0098 backend/Cargo.lock
HIGH RUSTSEC-2026-0049 rustls-webpki: RUSTSEC-2026-0049 backend/Cargo.lock
HIGH RUSTSEC-2026-0097 rand: RUSTSEC-2026-0097 backend/Cargo.lock
HIGH RUSTSEC-2026-0037 quinn-proto: RUSTSEC-2026-0037 backend/Cargo.lock
HIGH RUSTSEC-2024-0370 proc-macro-error: RUSTSEC-2024-0370 backend/Cargo.lock
HIGH RUSTSEC-2024-0436 paste: RUSTSEC-2024-0436 backend/Cargo.lock
HIGH RUSTSEC-2026-0002 lru: RUSTSEC-2026-0002 backend/Cargo.lock
HIGH RUSTSEC-2024-0419 gtk3-macros: RUSTSEC-2024-0419 backend/Cargo.lock
HIGH RUSTSEC-2024-0420 gtk-sys: RUSTSEC-2024-0420 backend/Cargo.lock
HIGH RUSTSEC-2024-0415 gtk: RUSTSEC-2024-0415 backend/Cargo.lock
HIGH RUSTSEC-2024-0429 glib: RUSTSEC-2024-0429 backend/Cargo.lock
HIGH RUSTSEC-2024-0414 gdkx11-sys: RUSTSEC-2024-0414 backend/Cargo.lock
HIGH RUSTSEC-2024-0417 gdkx11: RUSTSEC-2024-0417 backend/Cargo.lock
HIGH RUSTSEC-2024-0411 gdkwayland-sys: RUSTSEC-2024-0411 backend/Cargo.lock
HIGH RUSTSEC-2024-0418 gdk-sys: RUSTSEC-2024-0418 backend/Cargo.lock
HIGH RUSTSEC-2024-0412 gdk: RUSTSEC-2024-0412 backend/Cargo.lock
HIGH RUSTSEC-2025-0057 fxhash: RUSTSEC-2025-0057 backend/Cargo.lock
HIGH RUSTSEC-2026-0105 core2: RUSTSEC-2026-0105 backend/Cargo.lock
HIGH RUSTSEC-2025-0141 bincode: RUSTSEC-2025-0141 backend/Cargo.lock
HIGH RUSTSEC-2023-0089 atomic-polyfill: RUSTSEC-2023-0089 backend/Cargo.lock
HIGH RUSTSEC-2024-0416 atk-sys: RUSTSEC-2024-0416 backend/Cargo.lock
HIGH RUSTSEC-2024-0413 atk: RUSTSEC-2024-0413 backend/Cargo.lock
HIGH RUSTSEC-2025-0056 adler: RUSTSEC-2025-0056 backend/Cargo.lock
MED SEC134 [SEC134] AI scaffold leftover — Lorem ipsum / example.com / John Doe in code: Lorem ipsum… backend/tauri/src/config/profile/tests.…:63
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … frontend/nyanpasu/src/utils/custom-css-…:244
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … frontend/nyanpasu/src/pages/(editor)/ed…:132
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … frontend/nyanpasu/src/pages/(editor)/ed…:69
MED GHSA-3v7f-55p6-f55p picomatch: GHSA-3v7f-55p6-f55p pnpm-lock.yaml
MED GHSA-4fh9-h7wg-q85m mdast-util-to-hast: GHSA-4fh9-h7wg-q85m pnpm-lock.yaml
MED GHSA-v9jr-rg53-9pgp dompurify: GHSA-v9jr-rg53-9pgp pnpm-lock.yaml
MED GHSA-v2wj-7wpq-c8vv dompurify: GHSA-v2wj-7wpq-c8vv pnpm-lock.yaml
MED GHSA-h8r8-wccr-v5f2 dompurify: GHSA-h8r8-wccr-v5f2 pnpm-lock.yaml
MED GHSA-h7mw-gpvr-xq4m dompurify: GHSA-h7mw-gpvr-xq4m pnpm-lock.yaml
MED GHSA-crv5-9vww-q3g8 dompurify: GHSA-crv5-9vww-q3g8 pnpm-lock.yaml
MED GHSA-cjmm-f4jc-qw8r dompurify: GHSA-cjmm-f4jc-qw8r pnpm-lock.yaml
MED GHSA-cj63-jhhr-wcxv dompurify: GHSA-cj63-jhhr-wcxv pnpm-lock.yaml
MED GHSA-39q2-94rc-95cp dompurify: GHSA-39q2-94rc-95cp pnpm-lock.yaml
MED GHSA-f886-m6hf-6m8v brace-expansion: GHSA-f886-m6hf-6m8v pnpm-lock.yaml
MED GHSA-2g4f-4pwh-qvx6 ajv: GHSA-2g4f-4pwh-qvx6 pnpm-lock.yaml
MED GHSA-3pv8-6f4r-ffg2 tar: GHSA-3pv8-6f4r-ffg2 backend/Cargo.lock
MED AGT007 localStorage write failures are swallowed silently frontend/interface/src/hooks/use-kv-sto…:24
LOW DEPCUR-GHA GitHub Action `actions/setup-node@v6` is minor version(s) behind (latest v6.4.0) .github/workflows/daily.yml:17
LOW DEPCUR-GHA GitHub Action `Swatinem/rust-cache@v2` is minor version(s) behind (latest v2.9.1) .github/workflows/deps-build-linux.yaml:108
LOW DEPCUR-GHA GitHub Action `actions/setup-node@v6` is minor version(s) behind (latest v6.4.0) .github/workflows/deps-build-linux.yaml:83
LOW DEPCUR-GHA GitHub Action `actions/setup-node@v6` is minor version(s) behind (latest v6.4.0) .github/workflows/deps-message-telegram…:39
LOW DEPCUR-GHA GitHub Action `orhun/git-cliff-action@v4` is minor version(s) behind (latest v4.8.0) backend/tauri-plugin-deep-link/.github/…:24
LOW DEPCUR-GHA GitHub Action `Swatinem/rust-cache@v2` is minor version(s) behind (latest v2.9.1) backend/tauri-plugin-deep-link/.github/…:23
LOW DEPCUR-GHA GitHub Action `actions-rs/audit-check@v1` is minor version(s) behind (latest v1.2.0) backend/tauri-plugin-deep-link/.github/…:24
LOW DEPCUR-GHA GitHub Action `Swatinem/rust-cache@v2` is minor version(s) behind (latest v2.9.1) backend/tauri-plugin-deep-link/.github/…:26
LOW GHSA-52f5-9888-hmc6 tmp: GHSA-52f5-9888-hmc6 pnpm-lock.yaml
LOW GHSA-73rr-hh4g-fpgx diff: GHSA-73rr-hh4g-fpgx pnpm-lock.yaml
LOW GHSA-v6h2-p8h4-qcjw brace-expansion: GHSA-v6h2-p8h4-qcjw pnpm-lock.yaml
LOW AIC003 Duplicated implementation block across source files frontend/nyanpasu/src/pages/(main)/main…:45
LOW AIC003 Duplicated implementation block across source files frontend/nyanpasu/src/pages/(main)/main…:45
LOW AIC003 Duplicated implementation block across source files frontend/nyanpasu/src/pages/(main)/main…:3
LOW AIC003 Duplicated implementation block across source files frontend/nyanpasu/src/pages/(main)/main…:3
LOW AIC003 Duplicated implementation block across source files frontend/nyanpasu/src/pages/(main)/main…:3
LOW AIC003 Duplicated implementation block across source files frontend/nyanpasu/src/pages/(main)/main…:310
LOW AIC003 Duplicated implementation block across source files frontend/nyanpasu/src/pages/(main)/main…:25
LOW AIC003 Duplicated implementation block across source files frontend/nyanpasu/src/pages/(main)/main…:3
LOW AIC003 Duplicated implementation block across source files frontend/nyanpasu/src/pages/(main)/main…:22
LOW AIC003 Duplicated implementation block across source files frontend/nyanpasu/src/pages/(main)/main…:5
LOW AIC003 Duplicated implementation block across source files frontend/nyanpasu/src/pages/(main)/main…:73
LOW AIC003 Duplicated implementation block across source files frontend/nyanpasu/src/pages/(main)/main…:59
LOW AIC003 Duplicated implementation block across source files frontend/nyanpasu/src/pages/(main)/main…:151
LOW AIC003 Duplicated implementation block across source files frontend/nyanpasu/src/pages/(main)/main…:88
LOW AIC003 Duplicated implementation block across source files frontend/nyanpasu/src/pages/(main)/main…:97
LOW AIC003 Duplicated implementation block across source files frontend/nyanpasu/src/pages/(main)/main…:4
LOW AIC003 Duplicated implementation block across source files frontend/nyanpasu/src/pages/(main)/main…:32
LOW AIC003 Duplicated implementation block across source files frontend/nyanpasu/src/components/ui/sel…:18
LOW AIC003 Duplicated implementation block across source files frontend/nyanpasu/src/components/ui/dro…:7
LOW AIC003 Duplicated implementation block across source files frontend/interface/src/service/types.ts:78
LOW AIC003 Duplicated implementation block across source files backend/tauri/src/window.rs:658
LOW AIC003 Duplicated implementation block across source files backend/tauri/src/core/sysopt.rs:55
LOW AIC003 Duplicated implementation block across source files backend/tauri/src/core/state.rs:146
LOW AIC003 Duplicated implementation block across source files backend/tauri/src/core/migration/units/…:85
LOW AIC003 Duplicated implementation block across source files backend/nyanpasu-egui/src/widget/networ…:25
LOW AIC003 Duplicated implementation block across source files backend/nyanpasu-core/src/state/manager…:79
LOW AIC003 Duplicated implementation block across source files backend/nyanpasu-core/src/state/manager…:1
LOW AIC003 Duplicated implementation block across source files backend/nyanpasu-core/src/state/manager…:65
LOW AIC003 Duplicated implementation block across source files backend/nyanpasu-core/src/state/manager…:63
LOW AIC003 Duplicated implementation block across source files backend/nyanpasu-core/src/state/manager…:1
LOW AIC002 Source file name looks like an AI patch artifact frontend/nyanpasu/src/pages/(main)/main…:1
LOW AIC002 Source file name looks like an AI patch artifact frontend/nyanpasu/src/pages/(main)/main…:1
LOW AIC002 Source file name looks like an AI patch artifact backend/nyanpasu-macro/src/builder_upda…:1
INFO MINED088 [MINED088] React Conditional Hook: useState/useEffect inside if/loop violates Rules of Ho… frontend/nyanpasu/src/utils/get-strict-…:22
INFO MINED058 [MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escapi… frontend/nyanpasu/src/pages/(main)/main…:214
INFO MINED045 [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError … frontend/nyanpasu/src/pages/(main)/main…:39
INFO MINED045 [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError … frontend/nyanpasu/src/components/ui/seg…:275
INFO MINED045 [MINED045] Ts Non Null Assertion: x! asserts not null - bypasses null checks - TypeError … frontend/nyanpasu/src/components/ui/scr…:133
INFO MINED056 [MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re… frontend/nyanpasu/src/pages/(main)/main…:15
INFO MINED056 [MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re… frontend/nyanpasu/src/pages/(main)/main…:213
INFO MINED056 [MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re… frontend/nyanpasu/src/components/ui/hig…:53
INFO MINED054 [MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely. frontend/nyanpasu/vite.config.ts:174
INFO MINED054 [MINED054] Ts As Any: Casting to any (as any) bypasses type checking entirely. frontend/nyanpasu/src/components/router…:98
INFO MINED052 [MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety. frontend/nyanpasu/src/utils/index.ts:18
INFO MINED052 [MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety. frontend/nyanpasu/src/pages/(main)/main…:32
INFO MINED052 [MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety. frontend/nyanpasu/src/components/primit…:27
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … frontend/interface/src/provider/clash-w…:75
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … frontend/interface/src/ipc/use-clash-co…:52
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … frontend/interface/src/hooks/use-kv-sto…:180
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… backend/tauri/src/utils/config.rs:19
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… backend/tauri/src/core/download/mod.rs:184
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… backend/tauri/src/core/download/adapter…:167
INFO MINED068 [MINED068] Rust Unsafe Block: unsafe { ... } block. Compiler safety guarantees disabled i… backend/tauri-plugin-deep-link/src/wind…:185
INFO MINED068 [MINED068] Rust Unsafe Block: unsafe { ... } block. Compiler safety guarantees disabled i… backend/tauri-plugin-deep-link/src/maco…:43
INFO MINED068 [MINED068] Rust Unsafe Block: unsafe { ... } block. Compiler safety guarantees disabled i… backend/nyanpasu-egui/src/widget/mod.rs:33
INFO MINED066 [MINED066] Rust Panic Macro: panic!() unwinds the stack. Use Result for recoverable error… backend/nyanpasu-core/src/state/manager…:123
INFO MINED066 [MINED066] Rust Panic Macro: panic!() unwinds the stack. Use Result for recoverable error… backend/boa_utils/src/module/http.rs:262
INFO MINED066 [MINED066] Rust Panic Macro: panic!() unwinds the stack. Use Result for recoverable error… backend/boa_utils/src/module/builtin.rs:132
INFO MINED059 [MINED059] Rust Expect In Prod: .expect(...) panics same as unwrap with a custom message. backend/tauri-plugin-deep-link/example/…:38
INFO MINED059 [MINED059] Rust Expect In Prod: .expect(...) panics same as unwrap with a custom message. backend/nyanpasu-core/src/state/version…:38
INFO MINED059 [MINED059] Rust Expect In Prod: .expect(...) panics same as unwrap with a custom message. backend/boa_utils/src/module/http.rs:91
INFO DEPCUR-GHA GitHub Action `pnpm/action-setup@v6` is patch version(s) behind (latest v6.0.8) .github/workflows/daily.yml:20
INFO DEPCUR-GHA GitHub Action `actions/checkout@v6` is patch version(s) behind (latest v6.0.3) .github/workflows/daily.yml:15
INFO DEPCUR-GHA GitHub Action `actions/upload-artifact@v7` is patch version(s) behind (latest v7.0.1) .github/workflows/deps-build-linux.yaml:229
INFO DEPCUR-GHA GitHub Action `actions/cache@v5` is patch version(s) behind (latest v5.0.5) .github/workflows/deps-build-linux.yaml:100
INFO DEPCUR-GHA GitHub Action `denoland/setup-deno@v2` is patch version(s) behind (latest v2.0.4) .github/workflows/deps-build-linux.yaml:91
INFO DEPCUR-GHA GitHub Action `pnpm/action-setup@v6` is patch version(s) behind (latest v6.0.8) .github/workflows/deps-build-linux.yaml:86
INFO DEPCUR-GHA GitHub Action `actions/checkout@v6` is patch version(s) behind (latest v6.0.3) .github/workflows/deps-build-linux.yaml:50
INFO DEPCUR-GHA GitHub Action `actions/download-artifact@v8` is patch version(s) behind (latest v8.0.1) .github/workflows/deps-message-telegram…:50
INFO DEPCUR-GHA GitHub Action `denoland/setup-deno@v2` is patch version(s) behind (latest v2.0.4) .github/workflows/deps-message-telegram…:43
INFO DEPCUR-GHA GitHub Action `actions/checkout@v6` is patch version(s) behind (latest v6.0.3) .github/workflows/deps-message-telegram…:38
INFO DEPCUR-GHA GitHub Action `actions/checkout@v6` is patch version(s) behind (latest v6.0.3) .github/workflows/deps-delete-releases.…:24
INFO DEPCUR-GHA GitHub Action `actions/download-artifact@v8` is patch version(s) behind (latest v8.0.1) .github/workflows/deps-upload-release-a…:22
INFO DEPCUR-GHA GitHub Action `actions/checkout@v6` is patch version(s) behind (latest v6.0.3) .github/workflows/deps-upload-release-a…:19
INFO DEPCUR-GHA GitHub Action `actions/checkout@v6` is patch version(s) behind (latest v6.0.3) backend/tauri-plugin-deep-link/.github/…:14
INFO DEPCUR-GHA GitHub Action `actions/checkout@v6` is patch version(s) behind (latest v6.0.3) backend/tauri-plugin-deep-link/.github/…:19
INFO DEPCUR-GHA GitHub Action `actions/checkout@v6` is patch version(s) behind (latest v6.0.3) backend/tauri-plugin-deep-link/.github/…:23
INFO DEPCUR-GHA GitHub Action `actions/checkout@v6` is patch version(s) behind (latest v6.0.3) backend/tauri-plugin-deep-link/.github/…:22
Reset to top 5 200 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `libnyanpasu/clash-nyanpasu`

**Score: 68/100 (C)**  ·  211 findings  ·  scanned 2026-06-05 17:18 UTC  ·  71,375 LOC

| Severity | Count |
|---|---|
| CRITICAL | 0 |
| HIGH | 95 |
| MEDIUM | 18 |
| LOW | 44 |

📊 [Full filterable report](https://repobility.com/scan/2f46b2d1-2838-44e3-ad93-6e6b582c017b/)  ·  ![scorecard](https://repobility.com/scan/2f46b2d1-2838-44e3-ad93-6e6b582c017b/report.png?v=1780679933-s2)

### Top findings

1. **HIGH** `SEC083` — JS: new RegExp() with non-literal
   `scripts/manifest.ts:69`
2. **HIGH** `SEC040` — innerHTML XSS — template literal with server-supplied data
   `frontend/nyanpasu/src/pages/(main)/_modules/header-help-action.tsx:37` · CWE-79 · A03:2021 Injection (XSS)
3. **HIGH** `SEC085` — JS: child_process.exec with non-literal
   `frontend/nyanpasu/src/utils/custom-css-compiler.ts:244`
4. **HIGH** `SEC085` — JS: child_process.exec with non-literal
   `frontend/nyanpasu/src/pages/(editor)/editor/profile/index.tsx:132`
5. **HIGH** `SEC085` — JS: child_process.exec with non-literal
   `frontend/nyanpasu/src/pages/(editor)/editor/_modules/utils.tsx:69`

---

**Security note**: this issue is public. If any flagged finding is a real, exploitable vulnerability, please redirect to your `SECURITY.md` policy or open a [private security advisory](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) instead. We're happy to close this and re-submit privately.

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/2f46b2d1-2838-44e3-ad93-6e6b582c017b/_
Megaproject â high spam risk
Could not determine 'libnyanpasu/clash-nyanpasu' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Already filed
67/223 findings (30%) on this scan are already flagged as test-file, won't-fix, or suppressed. The scan is too noisy to file as a single issue. Curate down to specific actionable findings, or address the FP source first.
I read the warnings â override Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.