gin-gonic/gin

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

26 of your 88 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 2.59s · analysis 5.7s · 0.9 MB · GitHub API rate-limit (preflight)

https://github.com/gin-gonic/gin · scanned 2026-06-05 07:00 UTC (5 days, 23 hours ago) · 10 languages

124 raw signals (84 security + 40 graph) 81st percentile · Go · medium (20-100K LoC) System graph score 91 (lower by 14)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 5 days, 23 hours ago · v2 · 67 actionable findings from 2 signal sources. 37 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

88.9% cov · 4 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	100.0	0.15	15.00
`security_score`	47.4	0.25	11.85
`testing_score`	80.0	0.20	16.00
`documentation_score`	91.0	0.15	13.65
`practices_score`	94.0	0.15	14.10
`code_quality`	69.4	0.10	6.94
Overall		1.00	77.5

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 2 High 52 Medium 4 Low 3 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 63 System graph 4 Crowd 0 Layer: Security 5 Software 51 Quality 6 Cicd 3 Api 1 Frontend 1

Exclude dismissed / FP Exclude test files

Scan summary Quality grade B+ (78/100). Dimensions: security 47, maintainability 100. 84 findings (72 security). 23,917 lines analyzed.

Showing 59 of 67 actionable findings. 104 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Security checks security auth conf 0.70 2 occurrences [AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /user/:id.

A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /user/:id.

lines 174, 497

context.go:174, 497 (2 hits)

medium Security checks cicd CI/CD security conf 0.90 ✓ Repobility 16 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `github/codeql-action/init` pinned to mutable ref `@v4` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

4 files, 16 locations

.github/workflows/trivy-scan.yml:30, 41, 47 (6 hits)

.github/workflows/codeql.yml:40, 49 (4 hits)

.github/workflows/gin.yml:27, 81 (4 hits)

.github/workflows/goreleaser.yml:24 (2 hits)

CI/CD securitySupply chainGitHub Actions

low Security checks cicd CI/CD security conf 0.90 ✓ Repobility 17 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `actions/checkout` pinned to mutable ref `@v6` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

4 files, 17 locations

.github/workflows/gin.yml:19, 23, 58, 64, 67 (9 hits)

.github/workflows/goreleaser.yml:16, 20 (4 hits)

.github/workflows/codeql.yml:36 (2 hits)

.github/workflows/trivy-scan.yml:25 (2 hits)

CI/CD securitySupply chainGitHub Actions

high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5005

Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent

go.mod

high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5006

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

go.mod

high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5013

Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

go.mod

high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5014

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

go.mod

high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5015

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

go.mod

high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5016

Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh

go.mod

high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5017

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

go.mod

high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5018

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

go.mod

high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5019

Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh

go.mod

high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5020

Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

go.mod

high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5021

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

go.mod

high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5023

Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

go.mod

high Security checks software dependencies conf 0.88 golang.org/x/crypto: GO-2026-5033

Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2025-3955

CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2025-4006

Excessive CPU consumption in ParseAddress in net/mail

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2025-4007

Quadratic complexity when checking name constraints in crypto/x509

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2025-4008

ALPN negotiation error contains attacker controlled information in crypto/tls

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2025-4009

Quadratic complexity when parsing some invalid inputs in encoding/pem

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2025-4010

Insufficient validation of bracketed IPv6 hostnames in net/url

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2025-4011

Parsing DER payload can cause memory exhaustion in encoding/asn1

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2025-4012

Lack of limit when parsing cookies can cause memory exhaustion in net/http

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2025-4013

Panic when validating certificates with DSA public keys in crypto/x509

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2025-4014

Unbounded allocation when parsing GNU sparse map in archive/tar

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2025-4015

Excessive CPU consumption in Reader.ReadResponse in net/textproto

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2025-4155

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2025-4175

Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4337

Unexpected session resumption in crypto/tls

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4340

Handshake messages may be processed at the incorrect encryption level in crypto/tls

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4341

Memory exhaustion in query parameter parsing in net/url

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4342

Excessive CPU consumption when building archive index in archive/zip

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4601

Incorrect parsing of IPv6 host literals in net/url

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4602

FileInfo can escape from a Root in os

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4603

URLs in meta content attribute actions are not escaped in html/template

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4864

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4865

JsBraceDepth Context Tracking Bugs (XSS) in html/template

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4869

Unbounded allocation for old GNU sparse in archive/tar

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4870

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4918

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4946

Inefficient policy validation in crypto/x509

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4947

Unexpected work during chain building in crypto/x509

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4971

Panic in Dial and LookupPort when handling NUL byte on Windows in net

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4976

ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4977

Quadratic string concatenation in consumePhrase in net/mail

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4980

Escaper bypass leads to XSS in html/template

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4981

Crash when handling long CNAME response in net

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4982

Bypass of meta content URL escaping causes XSS in html/template

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-4986

Quadratic string concatentation in consumeComment in net/mail

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-5037

Inefficient candidate hostname parsing in crypto/x509

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-5038

Quadratic complexity in WordDecoder.DecodeHeader in mime

go.mod

high Security checks software dependencies conf 0.88 stdlib: GO-2026-5039

Arbitrary inputs are included in errors without any escaping in net/textproto

go.mod

medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

high Security checks security auth conf 0.74 [AUC002] Low visible authorization coverage in route inventory: Only 0.0% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.

Only 0.0% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.

medium Security checks software dependencies conf 0.88 github.com/quic-go/quic-go: GHSA-vvgj-x9jq-8cj9

quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion

go.mod

medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/goreleaser.yml CI/CD securitySupply chainGithub actions

low Security checks quality Quality conf 0.60 Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

binding/binding_nomsgpack.go:12 duplicationquality

low System graph quality Complexity conf 1.00 Very large file: context_test.go (3870 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/49e1c07a-fce2-4e25-965f-9ae544fa2dcb/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/49e1c07a-fce2-4e25-965f-9ae544fa2dcb/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.