← Back to scan
File as GitHub Issue repo: rclone/rclone

Push this scan report to rclone/rclone

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Go Recover Without Log

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT MINED107 [MINED107] Missing import: `email` used but not imported: The file uses `email.something(… bin/update-authors.py:59
CRIT MINED116 [MINED116] Workflow uses `secrets.RCLONE_CONFIG_PASS` on a `pull_request` trigger: This w… .github/workflows/build.yml:496
CRIT MINED116 [MINED116] Workflow uses `secrets.RCLONE_CONFIG_PASS` on a `pull_request` trigger: This w… .github/workflows/build.yml:245
HIGH MINED106 [MINED106] Phantom test coverage: test_server: Test function `test_server` runs code but … bin/manage_backends.py:103
HIGH MINED033 [MINED033] Go Recover Without Log: defer func() { recover() }() that silently swallows pa… librclone/librclone/librclone.go:84
HIGH MINED033 [MINED033] Go Recover Without Log: defer func() { recover() }() that silently swallows pa… cmd/serve/dlna/dlna_util.go:172
HIGH MINED033 [MINED033] Go Recover Without Log: defer func() { recover() }() that silently swallows pa… cmd/cmount/mount.go:154
HIGH SEC093 [SEC093] Go: exec.Command with non-literal: exec.Command(<var>) — variable command name a… fstest/testserver/testserver.go:62
HIGH SEC093 [SEC093] Go: exec.Command with non-literal: exec.Command(<var>) — variable command name a… backend/sftp/ssh_external.go:100
HIGH MINED014 [MINED014] Disabled Tls Verify: verify=False in requests, rejectUnauthorized:false in nod… backend/cache/plex.go:122
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … backend/smb/kerberos.go:93
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … backend/cache/storage_memory.go:87
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … backend/cache/plex.go:176
HIGH SEC088 [SEC088] Go: TLS InsecureSkipVerify=true: tls.Config{InsecureSkipVerify:true} disables ce… backend/cache/plex.go:122
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… backend/imagekit/client/url.go:25
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… backend/doi/invenio.go:56
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… backend/cache/plex.go:159
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). backend/compress/gzip_handler.go:7
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). backend/box/upload.go:8
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). backend/box/api/types.go:64
HIGH MINED016 [MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern. backend/compress/gzip_handler.go:119
HIGH MINED016 [MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern. backend/cache/object.go:50
HIGH MINED016 [MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern. backend/archive/squashfs/squashfs.go:90
HIGH DKR014 Dockerfile copies the entire context without .dockerignore Dockerfile:26
HIGH MINED115 [MINED115] Action `actions/setup-go` pinned to mutable ref `@v6`: `uses: actions/setup-go… .github/workflows/build.yml:394
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout… .github/workflows/build.yml:387
HIGH MINED115 [MINED115] Action `DavidAnson/markdownlint-cli2-action` pinned to mutable ref `@v20`: `us… .github/workflows/build.yml:348
HIGH MINED115 [MINED115] Action `golangci/golangci-lint-action` pinned to mutable ref `@v9`: `uses: gol… .github/workflows/build.yml:334
HIGH MINED115 [MINED115] Action `golangci/golangci-lint-action` pinned to mutable ref `@v9`: `uses: gol… .github/workflows/build.yml:326
HIGH MINED115 [MINED115] Action `golangci/golangci-lint-action` pinned to mutable ref `@v9`: `uses: gol… .github/workflows/build.yml:318
HIGH MINED115 [MINED115] Action `golangci/golangci-lint-action` pinned to mutable ref `@v9`: `uses: gol… .github/workflows/build.yml:310
HIGH MINED115 [MINED115] Action `golangci/golangci-lint-action` pinned to mutable ref `@v9`: `uses: gol… .github/workflows/build.yml:304
HIGH MINED115 [MINED115] Action `actions/cache` pinned to mutable ref `@v5`: `uses: actions/cache@v5` r… .github/workflows/build.yml:295
HIGH MINED115 [MINED115] Action `actions/cache` pinned to mutable ref `@v5`: `uses: actions/cache@v5` r… .github/workflows/build.yml:286
HIGH MINED115 [MINED115] Action `actions/setup-go` pinned to mutable ref `@v6`: `uses: actions/setup-go… .github/workflows/build.yml:279
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout… .github/workflows/build.yml:273
HIGH MINED115 [MINED115] Action `actions/cache` pinned to mutable ref `@v5`: `uses: actions/cache@v5` r… .github/workflows/build.yml:145
HIGH MINED115 [MINED115] Action `actions/cache` pinned to mutable ref `@v5`: `uses: actions/cache@v5` r… .github/workflows/build.yml:134
HIGH MINED115 [MINED115] Action `actions/setup-go` pinned to mutable ref `@v6`: `uses: actions/setup-go… .github/workflows/build.yml:113
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout… .github/workflows/build.yml:107
HIGH MINED115 [MINED115] Action `actions/download-artifact` pinned to mutable ref `@v8`: `uses: actions… .github/workflows/build_publish_docker_…:205
HIGH MINED115 [MINED115] Action `actions/upload-artifact` pinned to mutable ref `@v7`: `uses: actions/u… .github/workflows/build_publish_docker_…:190
HIGH MINED115 [MINED115] Action `reproducible-containers/buildkit-cache-dance` pinned to mutable ref `@… .github/workflows/build_publish_docker_…:146
HIGH MINED115 [MINED115] Action `actions/cache` pinned to mutable ref `@v5`: `uses: actions/cache@v5` r… .github/workflows/build_publish_docker_…:136
HIGH MINED115 [MINED115] Action `actions/github-script` pinned to mutable ref `@v9`: `uses: actions/git… .github/workflows/build_publish_docker_…:99
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout… .github/workflows/build_publish_docker_…:59
HIGH MINED115 [MINED115] Action `vedantmgoyal2009/winget-releaser` pinned to mutable ref `@v2`: `uses: … .github/workflows/winget.yml:13
HIGH MINED115 [MINED115] Action `jenschelkopf/issue-label-notification-action` pinned to mutable ref `@… .github/workflows/notify.yml:14
HIGH MINED115 [MINED115] Action `actions/checkout` pinned to mutable ref `@v6`: `uses: actions/checkout… .github/workflows/build_publish_docker_…:36
HIGH MINED118 [MINED118] Dockerfile FROM `alpine:latest` not pinned by digest: `FROM alpine:latest` res… contrib/docker-plugin/managed/Dockerfile:5
HIGH MINED118 [MINED118] Dockerfile FROM `alpine:latest` not pinned by digest: `FROM alpine:latest` res… fstest/testserver/images/test-sftp-open…:2
HIGH MINED118 [MINED118] Dockerfile FROM `debian:stretch` not pinned by digest: `FROM debian:stretch` r… fstest/testserver/images/test-hdfs/Dock…:2
HIGH MINED118 [MINED118] Dockerfile FROM `alpine:latest` not pinned by digest: `FROM alpine:latest` res… Dockerfile:36
HIGH MINED118 [MINED118] Dockerfile FROM `golang:alpine` not pinned by digest: `FROM golang:alpine` res… Dockerfile:1
HIGH SEC013 [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file pat… cmd/mount/file.go:67
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… bin/check_autogenerated_edits.py:44
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… bin/make_backend_docs.py:82
MED MINED111 [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that r… bin/make_backend_docs.py:73
MED SEC094 [SEC094] Go: world-writable file permissions: File or directory created with world-writab… vfs/vfstest/file.go:36
MED SEC091 [SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/Read… fs/rc/js/serve.go:18
MED SEC089 [SEC089] Go: bind to all interfaces (0.0.0.0): Server binds to all network interfaces — e… fs/rc/js/serve.go:18
MED SEC112 [SEC112] Go html/template bypass — text/template used for HTML output, or template.HTML o… cmd/tree/tree.go:156
MED SEC112 [SEC112] Go html/template bypass — text/template used for HTML output, or template.HTML o… cmd/lsf/lsf.go:258
MED DKR003 Dockerfile base image uses the latest tag fstest/testserver/images/test-sftp-open…:2
MED DKR003 Dockerfile base image uses the latest tag contrib/docker-plugin/managed/Dockerfile:5
MED DKR003 Dockerfile base image uses the latest tag Dockerfile:36
MED AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks… —
MED DKR007 Docker build context has no .dockerignore .dockerignore
MED DKC015 Database service has no healthcheck fstest/testserver/init.d/seafile/docker…:2
MED DKR001 Docker final stage has no non-root USER fstest/testserver/images/test-sftp-open…:2
MED DKR001 Docker final stage has no non-root USER fstest/testserver/images/test-hdfs/Dock…:2
MED DKR001 Docker final stage has no non-root USER contrib/docker-plugin/managed/Dockerfile:5
MED DKR001 Docker final stage has no non-root USER Dockerfile:36
MED AUC002 [AUC002] Low visible authorization coverage in route inventory: Only 21.9% of discovered … —
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … backend/jottacloud/jottacloud.go:655
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … backend/mailru/mailru.go:497
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … backend/mailru/mailru.go:494
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … backend/pcloud/pcloud.go:84
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … backend/yandex/yandex.go:265
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … lib/oauthutil/oauthutil.go:725
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … lib/oauthutil/oauthutil.go:724
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … lib/oauthutil/oauthutil.go:633
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … cmd/serve/dlna/dlna.go:352
MED AUC009 [AUC009] Sensitive function route lacks elevated authorization evidence: A route appears … cmd/serve/http/http.go:324
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… backend/onedrive/onedrive.go:493
MED AUC004 [AUC004] Admin route does not show super_admin separation: An administrative route was de… backend/onedrive/onedrive.go:488
LOW ERR003 [ERR003] Ignored Error (Go): Ignoring error return values. backend/compress/zstd_handler.go:154
LOW ERR003 [ERR003] Ignored Error (Go): Ignoring error return values. backend/cache/object.go:138
LOW ERR003 [ERR003] Ignored Error (Go): Ignoring error return values. backend/box/upload.go:227
LOW SEC132 [SEC132] String concat where the language has interpolation (AI style drift): String buil… backend/s3/providers.go:90
LOW SEC132 [SEC132] String concat where the language has interpolation (AI style drift): String buil… backend/putio/object.go:140
LOW SEC132 [SEC132] String concat where the language has interpolation (AI style drift): String buil… backend/box/upload.go:89
LOW AIC003 Duplicated implementation block across source files cmd/move/move.go:59
LOW AIC003 Duplicated implementation block across source files cmd/mount2/fs.go:36
LOW AIC003 Duplicated implementation block across source files cmd/lsl/lsl.go:2
LOW AIC003 Duplicated implementation block across source files backend/yandex/yandex.go:679
LOW AIC003 Duplicated implementation block across source files backend/yandex/yandex.go:120
LOW AIC003 Duplicated implementation block across source files backend/union/upstream/upstream.go:207
LOW AIC003 Duplicated implementation block across source files backend/union/union.go:392
LOW AIC003 Duplicated implementation block across source files backend/sia/sia.go:98
LOW AIC003 Duplicated implementation block across source files backend/shade/shade.go:584
LOW AIC003 Duplicated implementation block across source files backend/shade/shade.go:581
LOW AIC003 Duplicated implementation block across source files backend/putio/object.go:43
LOW AIC003 Duplicated implementation block across source files backend/premiumizeme/premiumizeme.go:602
LOW AIC003 Duplicated implementation block across source files backend/premiumizeme/premiumizeme.go:236
LOW AIC003 Duplicated implementation block across source files backend/pcloud/api/types.go:8
LOW AIC003 Duplicated implementation block across source files backend/oracleobjectstorage/oracleobjec…:206
LOW AIC003 Duplicated implementation block across source files backend/opendrive/opendrive.go:654
LOW AIC003 Duplicated implementation block across source files backend/opendrive/opendrive.go:188
LOW AIC003 Duplicated implementation block across source files backend/local/metadata_unix.go:8
LOW AIC003 Duplicated implementation block across source files backend/local/metadata_unix.go:1
LOW AIC003 Duplicated implementation block across source files backend/linkbox/linkbox.go:147
LOW AIC003 Duplicated implementation block across source files backend/internxt/internxt.go:331
LOW AIC003 Duplicated implementation block across source files backend/iclouddrive/iclouddrive.go:505
LOW AIC003 Duplicated implementation block across source files backend/http/http.go:503
LOW AIC003 Duplicated implementation block across source files backend/hidrive/hidrive.go:514
LOW AIC003 Duplicated implementation block across source files backend/hdfs/object.go:18
LOW AIC003 Duplicated implementation block across source files backend/hasher/hasher.go:426
LOW AIC003 Duplicated implementation block across source files backend/gofile/api/types.go:3
LOW AIC003 Duplicated implementation block across source files backend/filescom/filescom.go:505
LOW AIC003 Duplicated implementation block across source files backend/filelu/filelu_object.go:52
LOW AIC003 Duplicated implementation block across source files backend/compress/zstd_handler.go:21
LOW DKC016 App service does not wait for database health fstest/testserver/init.d/seafile/docker…:14
LOW DKC010 Compose service lacks no-new-privileges hardening fstest/testserver/init.d/seafile/docker…:14
LOW DKC017 Database password is wired through an environment variable placeholder fstest/testserver/init.d/seafile/docker…:2
LOW DKC006 Compose service does not declare a runtime user fstest/testserver/init.d/seafile/docker…:14
LOW CORE_NO_LICENSE No LICENSE file —
INFO MINED057 [MINED057] Todo Bomb: Code path with a TODO/FIXME/HACK comment that gates correctness — l… vfs/vfstest/file.go:237
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… librclone/python/rclone.py:33
INFO MINED048 [MINED048] Php Error Suppress: @function() suppresses errors silently. Hides real issues. librclone/php/test.php:48
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … fs/rc/js/loader.js:32
INFO MINED060 [MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks g… backend/oracleobjectstorage/copy.go:118
INFO MINED060 [MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks g… backend/iclouddrive/api/client.go:60
INFO MINED060 [MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks g… backend/compress/szstd_helper.go:92
INFO MINED071 [MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases. backend/crypt/pkcs7/pkcs7.go:24
INFO MINED071 [MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases. backend/compress/zstd_handler.go:180
INFO MINED071 [MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases. backend/compress/gzip_handler.go:195
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… cmd/rc/rc.go:57
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… backend/webdav/odrvcookie/fetch.go:69
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… backend/cache/plex.go:114
Reset to top 5 140 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `rclone/rclone`

**Score: 77/100 (A-)**  ·  145 findings  ·  scanned 2026-06-05 09:56 UTC  ·  314,360 LOC

| Severity | Count |
|---|---|
| CRITICAL | 3 |
| HIGH | 52 |
| MEDIUM | 31 |
| LOW | 41 |

📊 [Full filterable report](https://repobility.com/scan/5a00e5cd-458d-444c-b328-c6d9527644dc/)  ·  ![scorecard](https://repobility.com/scan/5a00e5cd-458d-444c-b328-c6d9527644dc/report.png?v=1780653385-s2)

### Top findings

1. **CRITICAL** `MINED107` — Missing import: `email` used but not imported
   `bin/update-authors.py:59` · ✓ Repobility
2. **CRITICAL** `MINED116` — Workflow uses `secrets.RCLONE_CONFIG_PASS` on a `pull_request` trigger
   `.github/workflows/build.yml:496` · ✓ Repobility
3. **CRITICAL** `MINED116` — Workflow uses `secrets.RCLONE_CONFIG_PASS` on a `pull_request` trigger
   `.github/workflows/build.yml:245` · ✓ Repobility
4. **HIGH** `MINED106` — Phantom test coverage: test_server
   `bin/manage_backends.py:103` · ✓ Repobility
5. **HIGH** `MINED033` — Go Recover Without Log
   `librclone/librclone/librclone.go:84` · CWE-755 · ✓ Repobility

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/5a00e5cd-458d-444c-b328-c6d9527644dc/_
Megaproject â high spam risk
Could not determine 'rclone/rclone' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Open in GitHub to file this issue Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.