golang/go

Component	Sub-score	Weight	Contribution
`structure_score`	65.0	0.15	9.75
`security_score`	100.0	0.25	25.00
`testing_score`	85.0	0.20	17.00
`documentation_score`	93.0	0.15	13.95
`practices_score`	40.0	0.15	6.00
`code_quality`	70.0	0.10	7.00
Overall		1.00	78.7

critical 9-layer security secrets conf 1.00 Possible secret in src/cmd/go/internal/base/env.go

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

src/cmd/go/internal/base/env.go:26 secrets

critical 9-layer security secrets conf 1.00 Possible secret in src/cmd/go/internal/vcweb/hg.go

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

src/cmd/go/internal/vcweb/hg.go:104 secrets

critical 9-layer security secrets conf 1.00 Possible secret in src/internal/exportdata/exportdata.go

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

src/internal/exportdata/exportdata.go:331 secrets

critical 9-layer security secrets conf 1.00 Possible secret in src/net/url/gen_encoding_table.go

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

src/net/url/gen_encoding_table.go:143 secrets

critical 9-layer security secrets conf 1.00 Possible secret in src/os/exec/exec.go

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

src/os/exec/exec.go:1237 secrets

low Legacy quality quality conf 1.00 ✓ Repobility [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).

Review and fix per the pattern semantics. See CWE-327 / A02:2021 for context.

src/crypto/internal/boring/notboring.go:43 qualitylegacy

low Legacy quality quality conf 1.00 ✓ Repobility [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).

Review and fix per the pattern semantics. See CWE-327 / A02:2021 for context.

src/crypto/internal/boring/hmac.go:41 qualitylegacy

low Legacy quality quality conf 1.00 ✓ Repobility [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).

Review and fix per the pattern semantics. See CWE-327 / A02:2021 for context.

src/crypto/crypto.go:27 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED033] Go Recover Without Log: defer func() { recover() }() that silently swallows panic.

Review and fix per the pattern semantics. See CWE-755 / for context.

src/cmd/distpack/pack.go:329 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED033] Go Recover Without Log: defer func() { recover() }() that silently swallows panic.

Review and fix per the pattern semantics. See CWE-755 / for context.

src/cmd/compile/internal/syntax/syntax.go:68 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED033] Go Recover Without Log: defer func() { recover() }() that silently swallows panic.

Review and fix per the pattern semantics. See CWE-755 / for context.

src/cmd/compile/internal/syntax/dumper.go:28 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.invoke_per_goid` used but never assigned in __init__: Method `invoke` of class `GoroutineCmd` reads `self.invoke_per_goid`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.

Initialize `self.invoke_per_goid = <default>` in __init__, or add a class-level default.

src/runtime/runtime-gdb.py:635 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.len` used but never assigned in __init__: Method `__getitem__` of class `SliceValue` reads `self.len`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.

Initialize `self.len = <default>` in __init__, or add a class-level default.

src/runtime/runtime-gdb.py:96 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED108] `self.val` used but never assigned in __init__: Method `invoke` of class `GoLenFunc` reads `self.val`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.

Initialize `self.val = <default>` in __init__, or add a class-level default.

src/runtime/runtime-gdb.py:483 qualitylegacy

high Legacy software dependency conf 0.90 ✓ Repobility [MINED118] Dockerfile FROM `coqorg/coq:8.13.2` not pinned by digest: `FROM coqorg/coq:8.13.2` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

Replace with: `FROM coqorg/coq:8.13.2@sha256:<digest>`. Get the digest from `docker manifest inspect`. Re-pin via a scheduled bot (Renovate, Dependabot).

src/crypto/internal/fips140/nistec/fiat/Dockerfile:4 dependencylegacy

high Legacy security injection conf 0.80 [SEC005] Command Injection Risk: Unsafe shell execution or eval of user input.

Use subprocess with shell=False and a list of args. Never eval user input.

src/cmd/link/internal/ld/execarchive.go:33 injectionlegacy

low Legacy quality quality conf 1.00 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).

Use execFile / spawn with separate args array; never pass shell strings.

src/cmd/go/internal/toolchain/switch.go:111 qualitylegacy

low Legacy quality quality conf 1.00 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).

Use execFile / spawn with separate args array; never pass shell strings.

src/cmd/go/internal/toolchain/exec.go:61 qualitylegacy

low Legacy quality quality conf 1.00 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0).

Use execFile / spawn with separate args array; never pass shell strings.

misc/chrome/gophertool/gopher.js:29 qualitylegacy

high Legacy quality quality conf 1.00 [SEC088] Go: TLS InsecureSkipVerify=true: tls.Config{InsecureSkipVerify:true} disables certificate verification — MITM risk. Ported from gosec G402 (Apache-2.0).

Remove the option. If self-signed certs are required, pin via RootCAs.

src/cmd/pprof/pprof.go:87 qualitylegacy

high Legacy quality quality conf 1.00 [SEC088] Go: TLS InsecureSkipVerify=true: tls.Config{InsecureSkipVerify:true} disables certificate verification — MITM risk. Ported from gosec G402 (Apache-2.0).

Remove the option. If self-signed certs are required, pin via RootCAs.

src/cmd/go/internal/web/http.go:45 qualitylegacy

high Legacy quality quality conf 1.00 [SEC090] Go: math/rand used near crypto context: math/rand is not cryptographically secure. Use crypto/rand for tokens/keys. Ported from gosec G404 (Apache-2.0).

import `crypto/rand` and use `rand.Read(buf)`.

src/cmd/internal/par/work.go:10 qualitylegacy

high Legacy quality quality conf 1.00 [SEC090] Go: math/rand used near crypto context: math/rand is not cryptographically secure. Use crypto/rand for tokens/keys. Ported from gosec G404 (Apache-2.0).

import `crypto/rand` and use `rand.Read(buf)`.

src/cmd/go/internal/lockedfile/lockedfile_plan9.go:11 qualitylegacy

high Legacy quality quality conf 1.00 [SEC090] Go: math/rand used near crypto context: math/rand is not cryptographically secure. Use crypto/rand for tokens/keys. Ported from gosec G404 (Apache-2.0).

import `crypto/rand` and use `rand.Read(buf)`.

src/cmd/compile/internal/gc/compile.go:10 qualitylegacy

high Legacy quality quality conf 1.00 [SEC093] Go: exec.Command with non-literal: exec.Command(<var>) — variable command name allows command injection. Ported from gosec G204 (Apache-2.0).

Use a constant command name and validate args via a whitelist.

src/cmd/go/internal/cache/prog.go:87 qualitylegacy

high Legacy quality quality conf 1.00 [SEC093] Go: exec.Command with non-literal: exec.Command(<var>) — variable command name allows command injection. Ported from gosec G204 (Apache-2.0).

Use a constant command name and validate args via a whitelist.

src/cmd/go/internal/bug/bug.go:164 qualitylegacy

high Legacy quality quality conf 1.00 [SEC093] Go: exec.Command with non-literal: exec.Command(<var>) — variable command name allows command injection. Ported from gosec G204 (Apache-2.0).

Use a constant command name and validate args via a whitelist.

src/cmd/cover/func.go:203 qualitylegacy

high 9-layer security owasp conf 1.00 Insecure pattern 'eval_used' in src/cmd/go/internal/imports/build.go:88

Found a known-risky pattern (eval_used). Review and replace if possible.

src/cmd/go/internal/imports/build.go:88 owaspeval_used

high 9-layer security owasp conf 1.00 Insecure pattern 'eval_used' in src/cmd/go/internal/modindex/build.go:652

Found a known-risky pattern (eval_used). Review and replace if possible.

src/cmd/go/internal/modindex/build.go:652 owaspeval_used

high 9-layer security owasp conf 1.00 Insecure pattern 'eval_used' in src/cmd/go/internal/modindex/read.go:511

Found a known-risky pattern (eval_used). Review and replace if possible.

src/cmd/go/internal/modindex/read.go:511 owaspeval_used

high 9-layer security owasp conf 1.00 Insecure pattern 'eval_used' in src/cmd/internal/script/conds.go:81

Found a known-risky pattern (eval_used). Review and replace if possible.

src/cmd/internal/script/conds.go:81 owaspeval_used

high 9-layer security owasp conf 1.00 Insecure pattern 'exec_used' in src/runtime/os3_solaris.go:622

Found a known-risky pattern (exec_used). Review and replace if possible.

src/runtime/os3_solaris.go:622 owaspexec_used

high Legacy quality quality conf 1.00 ✓ Repobility [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

Either narrow the exception type, log the exception with `logger.exception(...)`, or re-raise after handling.

src/runtime/runtime-gdb.py:673 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

Either narrow the exception type, log the exception with `logger.exception(...)`, or re-raise after handling.

src/runtime/runtime-gdb.py:445 qualitylegacy

high Legacy quality quality conf 1.00 ✓ Repobility [MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose.

Either narrow the exception type, log the exception with `logger.exception(...)`, or re-raise after handling.

src/runtime/runtime-gdb.py:36 qualitylegacy

medium Legacy quality quality conf 1.00 [SEC089] Go: bind to all interfaces (0.0.0.0): Server binds to all network interfaces — exposes service beyond intended scope. Ported from gosec G102 (Apache-2.0).

Bind to `127.0.0.1:PORT` and front with a reverse proxy.

src/net/http/doc.go:71 qualitylegacy

medium Legacy quality quality conf 1.00 [SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/ReadTimeout/WriteTimeout is vulnerable to Slowloris. Ported from gosec G112 + G114 (Apache-2.0).

Construct `&http.Server{Addr: ..., ReadHeaderTimeout: 5*time.Second, ReadTimeout: 10*time.Second, WriteTimeout: 30*time.Second}`.

src/net/http/triv.go:139 qualitylegacy

medium Legacy quality quality conf 1.00 [SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/ReadTimeout/WriteTimeout is vulnerable to Slowloris. Ported from gosec G112 + G114 (Apache-2.0).

Construct `&http.Server{Addr: ..., ReadHeaderTimeout: 5*time.Second, ReadTimeout: 10*time.Second, WriteTimeout: 30*time.Second}`.

src/net/http/doc.go:71 qualitylegacy

medium Legacy quality quality conf 1.00 [SEC094] Go: world-writable file permissions: File or directory created with world-writable mode (e.g. 0666, 0777). Ported from gosec G301 / G302 / G306 (Apache-2.0).

Use 0600 for files, 0700 for dirs that should be private.

src/cmd/cgo/util.go:31 qualitylegacy

medium Legacy quality quality conf 1.00 [SEC094] Go: world-writable file permissions: File or directory created with world-writable mode (e.g. 0666, 0777). Ported from gosec G301 / G302 / G306 (Apache-2.0).

Use 0600 for files, 0700 for dirs that should be private.

misc/ios/go_ios_exec.go:82 qualitylegacy

medium Legacy software xss conf 1.00 [SEC112] Go html/template bypass — text/template used for HTML output, or template.HTML on user input: Go's `text/template` does no HTML escaping. `template.HTML(x)` marks data as already-safe. Using either with user input = XSS.

Use `html/template` (NOT `text/template`) for HTML responses. Never wrap user input with `template.HTML/JS/URL`.

src/cmd/trace/goroutines.go:232 xsslegacy

medium Legacy software xss conf 1.00 [SEC112] Go html/template bypass — text/template used for HTML output, or template.HTML on user input: Go's `text/template` does no HTML escaping. `template.HTML(x)` marks data as already-safe. Using either with user input = XSS.

Use `html/template` (NOT `text/template`) for HTML responses. Never wrap user input with `template.HTML/JS/URL`.

src/cmd/internal/pgo/serialize.go:52 xsslegacy

medium Legacy software xss conf 1.00 [SEC112] Go html/template bypass — text/template used for HTML output, or template.HTML on user input: Go's `text/template` does no HTML escaping. `template.HTML(x)` marks data as already-safe. Using either with user input = XSS.

Use `html/template` (NOT `text/template`) for HTML responses. Never wrap user input with `template.HTML/JS/URL`.

src/cmd/cover/html.go:57 xsslegacy

medium Legacy quality quality conf 1.00 [SEC123] Production stack trace / debug output exposed: Debug mode left on in production exposes stack traces, environment variables, framework internals — sometimes triggers RCE (Django debug page with arbitrary template eval).

Set DEBUG=False / APP_DEBUG=false in production. Provide a generic 500 handler that logs to backend but returns a sanitized page to clients.

src/crypto/internal/fips140/fips140.go:24 qualitylegacy

medium Legacy quality quality conf 1.00 [SEC123] Production stack trace / debug output exposed: Debug mode left on in production exposes stack traces, environment variables, framework internals — sometimes triggers RCE (Django debug page with arbitrary template eval).

Set DEBUG=False / APP_DEBUG=false in production. Provide a generic 500 handler that logs to backend but returns a sanitized page to clients.

src/cmd/go/internal/run/run.go:151 qualitylegacy

medium Legacy quality quality conf 1.00 [SEC123] Production stack trace / debug output exposed: Debug mode left on in production exposes stack traces, environment variables, framework internals — sometimes triggers RCE (Django debug page with arbitrary template eval).

Set DEBUG=False / APP_DEBUG=false in production. Provide a generic 500 handler that logs to backend but returns a sanitized page to clients.

src/cmd/go/internal/doc/pkgsite.go:75 qualitylegacy

medium Legacy cicd docker conf 0.90 Docker build context has no .dockerignore

Add .dockerignore with at least .git, .env, private keys, dependency folders, build outputs, and local databases.

.dockerignore dockerlegacy

high Legacy cicd docker conf 0.82 Docker final stage has no non-root USER

Add a non-root USER in the final runtime stage after files and permissions are prepared.

src/crypto/internal/fips140/nistec/fiat/Dockerfile:5 dockerlegacy

high Legacy cicd docker conf 0.82 Docker final stage has no non-root USER

Add a non-root USER in the final runtime stage after files and permissions are prepared.

src/crypto/internal/boring/Dockerfile:8 dockerlegacy

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — src/internal/trace/traceviewer/static/webcomponents.min.js:14

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer hardware security conf 1.00 Dockerfile runs as root: src/crypto/internal/boring/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

securitycontainer

medium 9-layer hardware security conf 1.00 Dockerfile runs as root: src/crypto/internal/fips140/nistec/fiat/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

securitycontainer

medium 9-layer security owasp conf 1.00 Insecure pattern 'weak_hash' in src/crypto/crypto.go:27

Found a known-risky pattern (weak_hash). Review and replace if possible.

src/crypto/crypto.go:27 owaspweak_hash

medium 9-layer security owasp conf 1.00 Insecure pattern 'weak_hash' in src/crypto/internal/boring/hmac.go:41

Found a known-risky pattern (weak_hash). Review and replace if possible.

src/crypto/internal/boring/hmac.go:41 owaspweak_hash

medium 9-layer security owasp conf 1.00 Insecure pattern 'weak_hash' in src/crypto/internal/boring/notboring.go:43

Found a known-risky pattern (weak_hash). Review and replace if possible.

src/crypto/internal/boring/notboring.go:43 owaspweak_hash

medium 9-layer security owasp conf 1.00 Insecure pattern 'weak_hash' in src/crypto/internal/boring/sha.go:76

Found a known-risky pattern (weak_hash). Review and replace if possible.

src/crypto/internal/boring/sha.go:76 owaspweak_hash

medium 9-layer security owasp conf 1.00 Insecure pattern 'weak_hash' in src/crypto/internal/fips140/rsa/pkcs1v15.go:29

Found a known-risky pattern (weak_hash). Review and replace if possible.

src/crypto/internal/fips140/rsa/pkcs1v15.go:29 owaspweak_hash

medium 9-layer security owasp conf 1.00 Insecure pattern 'weak_hash' in src/crypto/sha1/sha1.go:21

Found a known-risky pattern (weak_hash). Review and replace if possible.

src/crypto/sha1/sha1.go:21 owaspweak_hash

medium 9-layer security owasp conf 1.00 Insecure pattern 'weak_hash' in src/crypto/tls/auth.go:152

Found a known-risky pattern (weak_hash). Review and replace if possible.

src/crypto/tls/auth.go:152 owaspweak_hash

medium 9-layer security owasp conf 1.00 Insecure pattern 'weak_hash' in src/crypto/tls/bogo_config.json:53

Found a known-risky pattern (weak_hash). Review and replace if possible.

src/crypto/tls/bogo_config.json:53 owaspweak_hash

medium 9-layer security owasp conf 1.00 Insecure pattern 'weak_hash' in src/crypto/tls/handshake_client.go:797

Found a known-risky pattern (weak_hash). Review and replace if possible.

src/crypto/tls/handshake_client.go:797 owaspweak_hash

medium 9-layer security owasp conf 1.00 Insecure pattern 'weak_hash' in src/crypto/tls/handshake_client_tls13.go:666

Found a known-risky pattern (weak_hash). Review and replace if possible.

src/crypto/tls/handshake_client_tls13.go:666 owaspweak_hash

medium 9-layer security owasp conf 1.00 Insecure pattern 'weak_hash' in src/crypto/tls/handshake_server.go:776

Found a known-risky pattern (weak_hash). Review and replace if possible.

src/crypto/tls/handshake_server.go:776 owaspweak_hash

medium 9-layer security owasp conf 1.00 Insecure pattern 'weak_hash' in src/crypto/tls/handshake_server_tls13.go:1094

Found a known-risky pattern (weak_hash). Review and replace if possible.

src/crypto/tls/handshake_server_tls13.go:1094 owaspweak_hash

medium 9-layer cicd coverage conf 1.00 No CI/CD pipelines detected

No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints.

coverage

low Legacy quality error_handling conf 1.00 [ERR003] Ignored Error (Go): Ignoring error return values.

Handle the error or use errcheck linter.

src/cmd/compile/internal/noder/linker.go:126 error_handlinglegacy

low Legacy quality error_handling conf 1.00 [ERR003] Ignored Error (Go): Ignoring error return values.

Handle the error or use errcheck linter.

src/cmd/compile/internal/gc/obj.go:192 error_handlinglegacy

low Legacy quality error_handling conf 1.00 [ERR003] Ignored Error (Go): Ignoring error return values.

Handle the error or use errcheck linter.

src/archive/zip/register.go:35 error_handlinglegacy

low Legacy quality quality conf 1.00 [SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template literals since ES6). Not a vulnerability on its own, but a style signature of cross-language AI rewrites — the model wrote idiomatic Java/C# and then translated mechanically. When this style appears in only *some* files of a repo, it's a strong indicator of an AI-driven rewrite that needs a human review p

Python: `f"prefix {var} suffix"`. JS/TS: `` `prefix ${var} suffix` ``. Add a lint rule (pyupgrade UP032, eslint prefer-template) so future PRs catch this automatically.

src/cmd/go/internal/fips140/mkzip.go:102 qualitylegacy

low Legacy quality quality conf 1.00 [SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template literals since ES6). Not a vulnerability on its own, but a style signature of cross-language AI rewrites — the model wrote idiomatic Java/C# and then translated mechanically. When this style appears in only *some* files of a repo, it's a strong indicator of an AI-driven rewrite that needs a human review p

Python: `f"prefix {var} suffix"`. JS/TS: `` `prefix ${var} suffix` ``. Add a lint rule (pyupgrade UP032, eslint prefer-template) so future PRs catch this automatically.

misc/ios/go_ios_exec.go:81 qualitylegacy

low Legacy quality quality conf 1.00 [SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template literals since ES6). Not a vulnerability on its own, but a style signature of cross-language AI rewrites — the model wrote idiomatic Java/C# and then translated mechanically. When this style appears in only *some* files of a repo, it's a strong indicator of an AI-driven rewrite that needs a human review p

Python: `f"prefix {var} suffix"`. JS/TS: `` `prefix ${var} suffix` ``. Add a lint rule (pyupgrade UP032, eslint prefer-template) so future PRs catch this automatically.

misc/chrome/gophertool/popup.js:33 qualitylegacy

low Legacy cicd docker conf 0.74 Dockerfile leaves apt package indexes in the image layer

End the apt install layer with `rm -rf /var/lib/apt/lists/*`.

src/crypto/internal/boring/Dockerfile:19 dockerlegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

src/cmd/compile/internal/ssa/_gen/ARM64Ops.go:75 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

src/cmd/compile/internal/pgoir/irgraph.go:254 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

src/cmd/compile/internal/noder/html.go:71 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

src/cmd/compile/internal/mips64/ssa.go:2 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

src/cmd/compile/internal/liveness/mergelocals.go:664 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

src/cmd/compile/internal/ir/reassign_consistency_check.go:20 qualitylegacy

high Legacy quality quality conf 0.86 Duplicated implementation block across source files

Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used.

src/cmd/asm/internal/arch/arm64.go:14 qualitylegacy

low 9-layer quality maintenance conf 1.00 1293 TODO/FIXME markers

High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.

maintenance

low 9-layer hardware coverage conf 1.00 Containers defined but no K8s/orchestration manifest found

Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.

coveragedeployment

low 9-layer hardware supply-chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: coqorg/coq:8.13.2

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

src/crypto/internal/fips140/nistec/fiat/Dockerfile:4 supply-chaindockerpinned-dependencies

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: lib/wasm/wasm_exec_node.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer software dead-code-candidate conf 1.00 File has no detected symbols: misc/chrome/gophertool/background.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

dead-code-candidate

low 9-layer quality integrity conf 1.00 Legacy-named symbol `_Gmoribund_unused` in src/runtime/runtime-gdb.py:45

Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.

integritylegacy-markerdead-code

low 9-layer quality integrity conf 1.00 Near-duplicate function bodies in 3 places

Functions with the same first-5-line body hash: src/runtime/runtime-gdb.py:children, src/runtime/runtime-gdb.py:children, src/runtime/runtime-gdb.py:children This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document w…

integrityduplicatedry

low 9-layer quality integrity conf 1.00 Near-duplicate function bodies in 5 places

Functions with the same first-5-line body hash: src/runtime/runtime-gdb.py:display_hint, src/runtime/runtime-gdb.py:display_hint, src/runtime/runtime-gdb.py:display_hint, src/runtime/runtime-gdb.py:display_hint This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see http…

integrityduplicatedry

low 9-layer quality integrity conf 1.00 Near-duplicate function bodies in 5 places

Functions with the same first-5-line body hash: src/runtime/runtime-gdb.py:to_string, src/runtime/runtime-gdb.py:to_string, src/runtime/runtime-gdb.py:to_string, src/runtime/runtime-gdb.py:to_string This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai…

integrityduplicatedry

low 9-layer quality integrity conf 1.00 Near-duplicate function bodies in 6 places

Functions with the same first-5-line body hash: src/runtime/runtime-gdb.py:invoke, src/runtime/runtime-gdb.py:invoke, src/runtime/runtime-gdb.py:invoke, src/runtime/runtime-gdb.py:invoke This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygien…

integrityduplicatedry

low 9-layer software dead-code conf 1.00 Possibly dead Python function: children

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/runtime/runtime-gdb.py:299 dead-code

low 9-layer software dead-code conf 1.00 Possibly dead Python function: display_hint

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/runtime/runtime-gdb.py:437 dead-code

low 9-layer software dead-code conf 1.00 Possibly dead Python function: ifacematcher

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/runtime/runtime-gdb.py:459 dead-code

low 9-layer software dead-code conf 1.00 Possibly dead Python function: invoke

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/runtime/runtime-gdb.py:668 dead-code

low 9-layer software dead-code conf 1.00 Possibly dead Python function: linked_list

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/runtime/runtime-gdb.py:526 dead-code

low 9-layer software dead-code conf 1.00 Possibly dead Python function: matcher

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/runtime/runtime-gdb.py:316 dead-code

low 9-layer software dead-code conf 1.00 Possibly dead Python function: to_string

No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.

src/runtime/runtime-gdb.py:440 dead-code

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — lib/wasm/wasm_exec.js:22

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — misc/chrome/gophertool/popup.js:18

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer frontend frontend-quality conf 1.00 Stray `console.log` in TS/JS — src/internal/trace/traceviewer/static/webcomponents.min.js:14

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

frontend-qualityfq.console-leak

low 9-layer quality complexity conf 1.00 Very large file: src/archive/zip/reader_test.go (1957 lines)