← Back to scan
File as GitHub Issue repo: FuelLabs/sway

Push this scan report to FuelLabs/sway

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Detected a Generic API Key, potentially exposing access to various services and sensitive

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/in_language_tests/test_program…:152
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/in_language_tests/test_program…:151
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:171
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:163
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:151
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:143
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:131
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:123
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:111
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:103
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:91
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:83
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:71
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:63
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:51
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:43
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:31
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:23
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:3
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:32
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:21
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:28
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… test/src/e2e_vm_tests/test_programs/sho…:11
CRIT MINED116 Workflow uses `secrets.CODSPEED_TOKEN` on a `pull_request` trigger .github/workflows/benchmark.yml:50
CRIT MINED116 Workflow uses `secrets.SLACK_WEBHOOK_NOTIFY_BUILD` on a `pull_request` trigger .github/workflows/ci.yml:786
CRIT MINED116 Workflow uses `secrets.FORCPUB_TOKEN` on a `pull_request` trigger .github/workflows/ci.yml:773
CRIT MINED116 Workflow uses `secrets.SLACK_WEBHOOK_NOTIFY_BUILD` on a `pull_request` trigger .github/workflows/ci.yml:753
CRIT MINED116 Workflow uses `secrets.CARGO_REGISTRY_TOKEN` on a `pull_request` trigger .github/workflows/ci.yml:740
CRIT MINED116 Workflow uses `secrets.SLACK_WEBHOOK_NOTIFY_BUILD` on a `pull_request` trigger .github/workflows/ci.yml:707
CRIT MINED116 Workflow uses `secrets.SLACK_WEBHOOK_NOTIFY_BUILD` on a `pull_request` trigger .github/workflows/ci.yml:675
CRIT MINED116 Workflow uses `secrets.APP_KEY` on a `pull_request` trigger .github/workflows/ci.yml:479
CRIT GHSA-jhxm-h53p-jm7w wasmtime: GHSA-jhxm-h53p-jm7w test/src/sdk-harness/Cargo.lock
CRIT GHSA-xx5w-cvp6-jv83 wasmtime: GHSA-xx5w-cvp6-jv83 test/src/sdk-harness/Cargo.lock
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… forc-plugins/forc-migrate/src/cli/mod.rs:71
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… forc-plugins/forc-migrate/src/cli/comma…:21
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… forc-plugins/forc-migrate/src/cli/comma…:34
HIGH MINED041 [MINED041] Rust Unimplemented Macro: unimplemented!() panics. Same as todo!() but convent… forc-plugins/forc-doc/src/render/title.…:77
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … sway-core/src/types/collect_types_metad…:37
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … forc-util/src/bytecode.rs:92
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … forc-plugins/forc-doc/src/render/search…:18
HIGH SEC040 [SEC040] innerHTML XSS — template literal with server-supplied data: Setting .innerHTML w… forc-plugins/forc-doc/src/render/search…:58
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… sway-lsp/src/utils/document.rs:14
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… sway-lsp/src/capabilities/rename.rs:79
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… forc-plugins/forc-doc/src/render/search…:14
HIGH SEC006 [SEC006] XSS Risk: Direct HTML injection without sanitization. forc-plugins/forc-doc/src/render/search…:58
HIGH MINED003 [MINED003] Rust Unwrap In Prod: .unwrap() panics if None/Err. Acceptable in tests; risky … forc-plugins/forc-debug/src/server/hand…:208
HIGH MINED003 [MINED003] Rust Unwrap In Prod: .unwrap() panics if None/Err. Acceptable in tests; risky … forc-plugins/forc-debug/src/server/hand…:90
HIGH MINED003 [MINED003] Rust Unwrap In Prod: .unwrap() panics if None/Err. Acceptable in tests; risky … .github/workflows/scripts/check-dep-ver…:40
HIGH DKR014 Dockerfile copies the entire context without .dockerignore deployment/Dockerfile:22
HIGH DKR014 Dockerfile copies the entire context without .dockerignore deployment/Dockerfile:14
HIGH MINED115 Action `dtolnay/rust-toolchain` pinned to mutable ref `@master` .github/workflows/ci.yml:103
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/ci.yml:100
HIGH MINED115 Action `Swatinem/rust-cache` pinned to mutable ref `@v2` .github/workflows/ci.yml:86
HIGH MINED115 Action `dtolnay/rust-toolchain` pinned to mutable ref `@master` .github/workflows/ci.yml:81
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/ci.yml:78
HIGH MINED115 Action `Swatinem/rust-cache` pinned to mutable ref `@v2` .github/workflows/ci.yml:66
HIGH MINED115 Action `dtolnay/rust-toolchain` pinned to mutable ref `@master` .github/workflows/ci.yml:61
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/ci.yml:58
HIGH MINED115 Action `peaceiris/actions-gh-pages` pinned to mutable ref `@v4` .github/workflows/gh-pages.yml:170
HIGH MINED115 Action `peaceiris/actions-gh-pages` pinned to mutable ref `@v4` .github/workflows/gh-pages.yml:150
HIGH MINED115 Action `peaceiris/actions-gh-pages` pinned to mutable ref `@v4` .github/workflows/gh-pages.yml:131
HIGH MINED115 Action `peaceiris/actions-gh-pages` pinned to mutable ref `@v4` .github/workflows/gh-pages.yml:123
HIGH MINED115 Action `peaceiris/actions-gh-pages` pinned to mutable ref `@v4` .github/workflows/gh-pages.yml:115
HIGH MINED115 Action `peaceiris/actions-gh-pages` pinned to mutable ref `@v4` .github/workflows/gh-pages.yml:100
HIGH MINED115 Action `peaceiris/actions-gh-pages` pinned to mutable ref `@v4` .github/workflows/gh-pages.yml:81
HIGH MINED115 Action `peaceiris/actions-gh-pages` pinned to mutable ref `@v4` .github/workflows/gh-pages.yml:73
HIGH MINED115 Action `peaceiris/actions-gh-pages` pinned to mutable ref `@v4` .github/workflows/gh-pages.yml:65
HIGH MINED115 Action `peaceiris/actions-mdbook` pinned to mutable ref `@v1` .github/workflows/gh-pages.yml:51
HIGH MINED115 Action `dtolnay/rust-toolchain` pinned to mutable ref `@master` .github/workflows/gh-pages.yml:26
HIGH MINED115 Action `Swatinem/rust-cache` pinned to mutable ref `@v2` .github/workflows/gh-pages.yml:22
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/gh-pages.yml:21
HIGH MINED115 Action `crate-ci/typos` pinned to mutable ref `@master` .github/workflows/spellcheck.yml:14
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/spellcheck.yml:11
HIGH MINED115 Action `actions-rs/audit-check` pinned to mutable ref `@v1` .github/workflows/nightly-cargo-audit.y…:12
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v6` .github/workflows/nightly-cargo-audit.y…:11
HIGH MINED118 Dockerfile FROM `ubuntu:20.04` not pinned by digest deployment/Dockerfile:26
HIGH MINED118 Dockerfile FROM `lukemathwalker/cargo-chef:latest-rust-1.87` not pinned by digest deployment/Dockerfile:2
HIGH GHSA-4w32-2493-32g7 yamux: GHSA-4w32-2493-32g7 test/src/sdk-harness/Cargo.lock
HIGH GHSA-vxx9-2994-q338 yamux: GHSA-vxx9-2994-q338 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2026-0114 wasmtime: RUSTSEC-2026-0114 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2026-0094 wasmtime: RUSTSEC-2026-0094 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2026-0093 wasmtime: RUSTSEC-2026-0093 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2026-0092 wasmtime: RUSTSEC-2026-0092 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2026-0091 wasmtime: RUSTSEC-2026-0091 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2026-0089 wasmtime: RUSTSEC-2026-0089 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2026-0088 wasmtime: RUSTSEC-2026-0088 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2026-0087 wasmtime: RUSTSEC-2026-0087 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2026-0086 wasmtime: RUSTSEC-2026-0086 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2026-0085 wasmtime: RUSTSEC-2026-0085 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2026-0049 rustls-webpki: RUSTSEC-2026-0049 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2026-0104 rustls-webpki: RUSTSEC-2026-0104 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2026-0099 rustls-webpki: RUSTSEC-2026-0099 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2026-0098 rustls-webpki: RUSTSEC-2026-0098 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2025-0134 rustls-pemfile: RUSTSEC-2025-0134 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2025-0010 ring: RUSTSEC-2025-0010 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2025-0009 ring: RUSTSEC-2025-0009 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2026-0097 rand: RUSTSEC-2026-0097 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2024-0436 paste: RUSTSEC-2024-0436 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2026-0002 lru: RUSTSEC-2026-0002 test/src/sdk-harness/Cargo.lock
HIGH GHSA-xqmp-fxgv-xvq5 libp2p-gossipsub: GHSA-xqmp-fxgv-xvq5 test/src/sdk-harness/Cargo.lock
HIGH GHSA-gc42-3jg7-rxr2 libp2p-gossipsub: GHSA-gc42-3jg7-rxr2 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2024-0384 instant: RUSTSEC-2024-0384 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2026-0119 hickory-proto: RUSTSEC-2026-0119 test/src/sdk-harness/Cargo.lock
HIGH GHSA-2pgj-5cv2-6xxw fuel-vm: GHSA-2pgj-5cv2-6xxw test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2024-0388 derivative: RUSTSEC-2024-0388 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2026-0105 core2: RUSTSEC-2026-0105 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2023-0089 atomic-polyfill: RUSTSEC-2023-0089 test/src/sdk-harness/Cargo.lock
HIGH RUSTSEC-2024-0320 yaml-rust: RUSTSEC-2024-0320 Cargo.lock
HIGH RUSTSEC-2025-0055 tracing-subscriber: RUSTSEC-2025-0055 Cargo.lock
HIGH RUSTSEC-2026-0104 rustls-webpki: RUSTSEC-2026-0104 Cargo.lock
HIGH RUSTSEC-2026-0099 rustls-webpki: RUSTSEC-2026-0099 Cargo.lock
HIGH RUSTSEC-2026-0098 rustls-webpki: RUSTSEC-2026-0098 Cargo.lock
HIGH RUSTSEC-2025-0134 rustls-pemfile: RUSTSEC-2025-0134 Cargo.lock
HIGH RUSTSEC-2024-0370 proc-macro-error: RUSTSEC-2024-0370 Cargo.lock
HIGH RUSTSEC-2024-0436 paste: RUSTSEC-2024-0436 Cargo.lock
HIGH GHSA-p3hw-mv63-rf9w gix-validate: GHSA-p3hw-mv63-rf9w Cargo.lock
HIGH RUSTSEC-2025-0021 gix-features: RUSTSEC-2025-0021 Cargo.lock
HIGH RUSTSEC-2026-0008 git2: RUSTSEC-2026-0008 Cargo.lock
HIGH RUSTSEC-2024-0388 derivative: RUSTSEC-2024-0388 Cargo.lock
HIGH RUSTSEC-2025-0141 bincode: RUSTSEC-2025-0141 Cargo.lock
HIGH RUSTSEC-2023-0089 atomic-polyfill: RUSTSEC-2023-0089 Cargo.lock
HIGH SEC013 [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file pat… sway-lsp/src/server.rs:41
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … forc-plugins/forc-migrate/src/cli/mod.rs:71
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … forc-plugins/forc-migrate/src/cli/comma…:21
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … forc-plugins/forc-migrate/src/cli/comma…:34
MED AUC001 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks… —
MED DKR007 Docker build context has no .dockerignore .dockerignore
MED DKR017 Dockerfile installs dependencies after copying the full source tree deployment/Dockerfile:23
MED DKR001 Docker final stage has no non-root USER deployment/Dockerfile:26
LOW AIC003 Duplicated implementation block across source files sway-ir/src/optimize/inline.rs:31
LOW AIC003 Duplicated implementation block across source files sway-core/src/semantic_analysis/type_ch…:274
LOW AIC003 Duplicated implementation block across source files sway-core/src/semantic_analysis/type_ch…:163
LOW AIC003 Duplicated implementation block across source files sway-core/src/semantic_analysis/ast_nod…:18
LOW AIC003 Duplicated implementation block across source files sway-core/src/semantic_analysis/ast_nod…:515
LOW AIC003 Duplicated implementation block across source files sway-core/src/language/ty/declaration/s…:89
LOW AIC003 Duplicated implementation block across source files sway-core/src/language/ty/declaration/c…:92
LOW AIC003 Duplicated implementation block across source files sway-core/src/decl_engine/parsed_id.rs:28
LOW AIC003 Duplicated implementation block across source files forc/src/ops/forc_predicate_root.rs:19
LOW AIC003 Duplicated implementation block across source files forc/src/ops/forc_build.rs:13
LOW AIC003 Duplicated implementation block across source files forc-plugins/forc-doc/src/render/search…:71
LOW AUC005 [AUC005] No authorization-focused tests detected: No test files with common authorization… —
LOW AIC002 Source file name looks like an AI patch artifact sway-lsp/src/capabilities/code_actions/…:1
LOW AIC002 Source file name looks like an AI patch artifact forc/src/ops/forc_clean.rs:1
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… sway-utils/src/constants.rs:19
INFO MINED057 [MINED057] Todo Bomb: Code path with a TODO/FIXME/HACK comment that gates correctness — l… sway-ast/src/pattern.rs:18
INFO MINED068 [MINED068] Rust Unsafe Block: unsafe { ... } block. Compiler safety guarantees disabled i… forc-test/src/ecal.rs:25
INFO MINED066 [MINED066] Rust Panic Macro: panic!() unwinds the stack. Use Result for recoverable error… sway-core/src/abi_generation/evm_abi.rs:191
INFO MINED066 [MINED066] Rust Panic Macro: panic!() unwinds the stack. Use Result for recoverable error… forc-plugins/forc-publish/src/forc_pub_…:211
INFO MINED066 [MINED066] Rust Panic Macro: panic!() unwinds the stack. Use Result for recoverable error… forc-plugins/forc-publish/src/error.rs:110
INFO MINED059 [MINED059] Rust Expect In Prod: .expect(...) panics same as unwrap with a custom message. forc-pkg/src/manifest/build_profile.rs:118
INFO MINED059 [MINED059] Rust Expect In Prod: .expect(...) panics same as unwrap with a custom message. .github/workflows/scripts/check-forc-ma…:8
INFO MINED059 [MINED059] Rust Expect In Prod: .expect(...) panics same as unwrap with a custom message. .github/workflows/scripts/check-dep-ver…:35
Reset to top 5 152 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `FuelLabs/sway`

**Score: 67/100 (C)**  ·  154 findings  ·  scanned 2026-06-05 09:28 UTC  ·  236,715 LOC

| Severity | Count |
|---|---|
| CRITICAL | 33 |
| HIGH | 89 |
| MEDIUM | 7 |
| LOW | 14 |

📊 [Full filterable report](https://repobility.com/scan/a4d86175-0c33-480b-a54b-69eec82c8821/)  ·  ![scorecard](https://repobility.com/scan/a4d86175-0c33-480b-a54b-69eec82c8821/report.png?v=1780651690-s2)

### Top findings

1. **CRITICAL** `generic-api-key` — Detected a Generic API Key, potentially exposing access to various services and sensitive 
   `test/src/in_language_tests/test_programs/ecr_inline_tests/src/main.sw:152`
2. **CRITICAL** `generic-api-key` — Detected a Generic API Key, potentially exposing access to various services and sensitive 
   `test/src/in_language_tests/test_programs/ecr_inline_tests/src/main.sw:151`
3. **CRITICAL** `generic-api-key` — Detected a Generic API Key, potentially exposing access to various services and sensitive 
   `test/src/e2e_vm_tests/test_programs/should_pass/storage_slots_json_generation/json_storage_slots_oracle_new_encoding.release.json:171`
4. **CRITICAL** `generic-api-key` — Detected a Generic API Key, potentially exposing access to various services and sensitive 
   `test/src/e2e_vm_tests/test_programs/should_pass/storage_slots_json_generation/json_storage_slots_oracle_new_encoding.release.json:163`
5. **CRITICAL** `generic-api-key` — Detected a Generic API Key, potentially exposing access to various services and sensitive 
   `test/src/e2e_vm_tests/test_programs/should_pass/storage_slots_json_generation/json_storage_slots_oracle_new_encoding.release.json:151`

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/a4d86175-0c33-480b-a54b-69eec82c8821/_
Already filed
This repo publishes a SECURITY.md policy and the scan contains 12 Critical/High security finding(s). Public issue filing would violate coordinated disclosure. Submit privately via the project's security reporting channel.
Megaproject â high spam risk
Could not determine 'FuelLabs/sway' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Already filed
93/159 findings (58%) on this scan are already flagged as test-file, won't-fix, or suppressed. The scan is too noisy to file as a single issue. Curate down to specific actionable findings, or address the FP source first.
Open in GitHub to file this issue Filing guard overridden Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.