← Back to scan
File as GitHub Issue repo: syncthing/syncthing

Push this scan report to syncthing/syncthing

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Identified a Private Key, which may compromise cryptographic security and sensitive data e

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT private-key Identified a Private Key, which may compromise cryptographic security and sensitive data … test/h4/key.pem:1
CRIT private-key Identified a Private Key, which may compromise cryptographic security and sensitive data … test/h4/https-key.pem:1
CRIT private-key Identified a Private Key, which may compromise cryptographic security and sensitive data … test/h3/https-key.pem:1
CRIT private-key Identified a Private Key, which may compromise cryptographic security and sensitive data … test/h2/key.pem:1
CRIT private-key Identified a Private Key, which may compromise cryptographic security and sensitive data … test/h3/key.pem:1
CRIT private-key Identified a Private Key, which may compromise cryptographic security and sensitive data … test/h2/https-key.pem:1
CRIT private-key Identified a Private Key, which may compromise cryptographic security and sensitive data … test/h1/key.pem:1
CRIT private-key Identified a Private Key, which may compromise cryptographic security and sensitive data … test/h1/https-key.pem:1
CRIT generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive… lib/rc/rc.go:37
CRIT private-key Identified a Private Key, which may compromise cryptographic security and sensitive data … lib/api/testdata/config/https-key.pem:1
CRIT MINED116 Workflow uses `secrets.S3_REGION` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:828
CRIT MINED116 Workflow uses `secrets.S3_ENDPOINT` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:827
CRIT MINED116 Workflow uses `secrets.S3_SECRET_ACCESS_KEY` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:826
CRIT MINED116 Workflow uses `secrets.S3_ACCESS_KEY_ID` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:825
CRIT MINED116 Workflow uses `secrets.S3_PROVIDER` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:824
CRIT MINED116 Workflow uses `secrets.NIGHTLY_BASE_URL` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:818
CRIT MINED116 Workflow uses `secrets.APT_GPG_KEYRING_BASE64` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:717
CRIT MINED116 Workflow uses `secrets.APT_GPG_KEYRING_BASE64` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:708
CRIT MINED116 Workflow uses `secrets.STSIGTOOL_PRIVATE_KEY` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:691
CRIT MINED116 Workflow uses `secrets.APPSTORECONNECT_API_KEY_ISSUER` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:529
CRIT MINED116 Workflow uses `secrets.APPSTORECONNECT_API_KEY_ID` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:528
CRIT MINED116 Workflow uses `secrets.APPSTORECONNECT_API_KEY` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:527
CRIT MINED116 Workflow uses `secrets.CODESIGN_IDENTITY` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:455
CRIT MINED116 Workflow uses `secrets.DEVELOPER_ID_CERTIFICATE_PASSWORD` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:454
CRIT MINED116 Workflow uses `secrets.DEVELOPER_ID_CERTIFICATE_BASE64` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:453
CRIT MINED116 Workflow uses `secrets.CODESIGN_IDENTITY` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:413
CRIT MINED116 Workflow uses `secrets.AZURE_TRUSTED_SIGNING_PROFILE` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:263
CRIT MINED116 Workflow uses `secrets.AZURE_TRUSTED_SIGNING_ACCOUNT` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:262
CRIT MINED116 Workflow uses `secrets.AZURE_TRUSTED_SIGNING_ENDPOINT` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:261
CRIT MINED116 Workflow uses `secrets.AZURE_TRUSTED_SIGNING_CLIENT_SECRET` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:260
CRIT MINED116 Workflow uses `secrets.AZURE_TRUSTED_SIGNING_CLIENT_ID` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:259
CRIT MINED116 Workflow uses `secrets.AZURE_TRUSTED_SIGNING_TENANT_ID` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:258
CRIT MINED116 Workflow uses `secrets.LOKI_PASSWORD` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:148
CRIT MINED116 Workflow uses `secrets.LOKI_USER` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:147
CRIT MINED116 Workflow uses `secrets.LOKI_URL` on a `pull_request` trigger .github/workflows/build-syncthing.yaml:146
HIGH SEC093 [SEC093] Go: exec.Command with non-literal: exec.Command(<var>) — variable command name a… script/next-version.go:123
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… internal/db/sqlite/db_service.go:227
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… internal/db/sqlite/db_kv.go:33
HIGH SEC085 [SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived in… internal/db/sqlite/basedb.go:272
HIGH SEC083 [SEC083] JS: new RegExp() with non-literal: new RegExp(<variable>) — variable input can c… gui/default/syncthing/core/uncamelFilte…:15
HIGH MINED014 [MINED014] Disabled Tls Verify: verify=False in requests, rejectUnauthorized:false in nod… cmd/syncthing/cli/client.go:60
HIGH MINED014 [MINED014] Disabled Tls Verify: verify=False in requests, rejectUnauthorized:false in nod… cmd/strelaysrv/main.go:178
HIGH SEC088 [SEC088] Go: TLS InsecureSkipVerify=true: tls.Config{InsecureSkipVerify:true} disables ce… cmd/syncthing/cli/client.go:60
HIGH SEC088 [SEC088] Go: TLS InsecureSkipVerify=true: tls.Config{InsecureSkipVerify:true} disables ce… cmd/strelaysrv/main.go:178
HIGH SEC100 [SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` orig… cmd/strelaysrv/status.go:40
HIGH SEC100 [SEC100] CORS permissive Access-Control-Allow-Origin: *: Permissive CORS policy (`*` orig… cmd/infra/stupgrades/main.go:151
HIGH SEC114 [SEC114] path.join / Path() on user-controlled segment without containment check: filepat… cmd/infra/stcrashreceiver/main.go:57
HIGH MINED016 [MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern. cmd/syncthing/cli/utils.go:35
HIGH MINED016 [MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern. cmd/syncthing/cli/operations.go:107
HIGH MINED016 [MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern. cmd/infra/stcrashreceiver/diskstore.go:134
HIGH SEC090 [SEC090] Go: math/rand used near crypto context: math/rand is not cryptographically secur… cmd/dev/stvanity/main.go:21
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… cmd/syncthing/openurl_windows.go:14
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… cmd/syncthing/openurl_unix.go:19
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… cmd/dev/stevents/main.go:45
HIGH DKR014 Dockerfile copies the entire context without .dockerignore Dockerfile.strelaysrv:8
HIGH DKR014 Dockerfile copies the entire context without .dockerignore Dockerfile.stdiscosrv:8
HIGH DKR014 Dockerfile copies the entire context without .dockerignore Dockerfile:16
HIGH MINED115 Action `actions/cache` pinned to mutable ref `@v4` .github/workflows/build-syncthing.yaml:423
HIGH MINED115 Action `actions/setup-go` pinned to mutable ref `@v6` .github/workflows/build-syncthing.yaml:418
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v5` .github/workflows/build-syncthing.yaml:417
HIGH MINED115 Action `actions/upload-artifact` pinned to mutable ref `@v4` .github/workflows/build-syncthing.yaml:396
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v5` .github/workflows/build-syncthing.yaml:376
HIGH MINED115 Action `actions/upload-artifact` pinned to mutable ref `@v4` .github/workflows/build-syncthing.yaml:360
HIGH MINED115 Action `actions/cache` pinned to mutable ref `@v4` .github/workflows/build-syncthing.yaml:334
HIGH MINED115 Action `actions/setup-go` pinned to mutable ref `@v6` .github/workflows/build-syncthing.yaml:327
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v5` .github/workflows/build-syncthing.yaml:326
HIGH MINED115 Action `actions/upload-artifact` pinned to mutable ref `@v4` .github/workflows/build-syncthing.yaml:281
HIGH MINED115 Action `actions/download-artifact` pinned to mutable ref `@v7` .github/workflows/build-syncthing.yaml:242
HIGH MINED115 Action `actions/upload-artifact` pinned to mutable ref `@v4` .github/workflows/build-syncthing.yaml:223
HIGH MINED115 Action `actions/cache` pinned to mutable ref `@v4` .github/workflows/build-syncthing.yaml:199
HIGH MINED115 Action `actions/setup-go` pinned to mutable ref `@v6` .github/workflows/build-syncthing.yaml:192
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v5` .github/workflows/build-syncthing.yaml:191
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v5` .github/workflows/build-syncthing.yaml:176
HIGH MINED115 Action `actions/setup-go` pinned to mutable ref `@v6` .github/workflows/build-syncthing.yaml:125
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v5` .github/workflows/build-syncthing.yaml:123
HIGH MINED115 Action `actions/setup-go` pinned to mutable ref `@v6` .github/workflows/build-syncthing.yaml:63
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v5` .github/workflows/build-syncthing.yaml:59
HIGH MINED115 Action `actions/setup-go` pinned to mutable ref `@v6` .github/workflows/build-infra-dockers.y…:36
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v5` .github/workflows/build-infra-dockers.y…:33
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v5` .github/workflows/trigger-nightly.yaml:18
HIGH MINED115 Action `actions/setup-go` pinned to mutable ref `@v6` .github/workflows/release-syncthing.yaml:23
HIGH MINED115 Action `actions/checkout` pinned to mutable ref `@v5` .github/workflows/release-syncthing.yaml:18
HIGH MINED128 go.mod replaces `github.com/mattn/go-sqlite3` — redirects to fork `github.com/calmh/go-sq… go.mod:114
HIGH MINED128 go.mod replaces `github.com/jackpal/gateway` — redirects to fork `github.com/marbens-arch… go.mod:111
HIGH MINED128 go.mod replaces `github.com/gobwas/glob` — redirects to fork `github.com/calmh/glob` go.mod:108
HIGH GO-2026-5039 stdlib: GO-2026-5039 go.mod
HIGH GO-2026-5038 stdlib: GO-2026-5038 go.mod
HIGH GO-2026-5037 stdlib: GO-2026-5037 go.mod
HIGH GO-2026-4986 stdlib: GO-2026-4986 go.mod
HIGH GO-2026-4982 stdlib: GO-2026-4982 go.mod
HIGH GO-2026-4981 stdlib: GO-2026-4981 go.mod
HIGH GO-2026-4980 stdlib: GO-2026-4980 go.mod
HIGH GO-2026-4977 stdlib: GO-2026-4977 go.mod
HIGH GO-2026-4976 stdlib: GO-2026-4976 go.mod
HIGH GO-2026-4971 stdlib: GO-2026-4971 go.mod
HIGH GO-2026-4947 stdlib: GO-2026-4947 go.mod
HIGH GO-2026-4946 stdlib: GO-2026-4946 go.mod
HIGH GO-2026-4918 stdlib: GO-2026-4918 go.mod
HIGH GO-2026-4870 stdlib: GO-2026-4870 go.mod
HIGH GO-2026-4869 stdlib: GO-2026-4869 go.mod
HIGH GO-2026-4865 stdlib: GO-2026-4865 go.mod
HIGH GO-2026-4864 stdlib: GO-2026-4864 go.mod
HIGH GO-2026-4603 stdlib: GO-2026-4603 go.mod
HIGH GO-2026-4602 stdlib: GO-2026-4602 go.mod
HIGH GO-2026-4601 stdlib: GO-2026-4601 go.mod
HIGH GO-2026-4342 stdlib: GO-2026-4342 go.mod
HIGH GO-2026-4341 stdlib: GO-2026-4341 go.mod
HIGH GO-2026-4340 stdlib: GO-2026-4340 go.mod
HIGH GO-2026-4337 stdlib: GO-2026-4337 go.mod
HIGH GO-2025-4175 stdlib: GO-2025-4175 go.mod
HIGH GO-2025-4155 stdlib: GO-2025-4155 go.mod
HIGH GO-2025-4015 stdlib: GO-2025-4015 go.mod
HIGH GO-2025-4014 stdlib: GO-2025-4014 go.mod
HIGH GO-2025-4013 stdlib: GO-2025-4013 go.mod
HIGH GO-2025-4012 stdlib: GO-2025-4012 go.mod
HIGH GO-2025-4011 stdlib: GO-2025-4011 go.mod
HIGH GO-2025-4010 stdlib: GO-2025-4010 go.mod
HIGH GO-2025-4009 stdlib: GO-2025-4009 go.mod
HIGH GO-2025-4008 stdlib: GO-2025-4008 go.mod
HIGH GO-2025-4007 stdlib: GO-2025-4007 go.mod
HIGH GO-2025-4006 stdlib: GO-2025-4006 go.mod
HIGH GO-2025-3955 stdlib: GO-2025-3955 go.mod
HIGH GO-2026-5033 golang.org/x/crypto: GO-2026-5033 go.mod
HIGH GO-2026-5023 golang.org/x/crypto: GO-2026-5023 go.mod
HIGH GO-2026-5021 golang.org/x/crypto: GO-2026-5021 go.mod
HIGH GO-2026-5020 golang.org/x/crypto: GO-2026-5020 go.mod
HIGH GO-2026-5019 golang.org/x/crypto: GO-2026-5019 go.mod
HIGH GO-2026-5018 golang.org/x/crypto: GO-2026-5018 go.mod
HIGH GO-2026-5017 golang.org/x/crypto: GO-2026-5017 go.mod
HIGH GO-2026-5016 golang.org/x/crypto: GO-2026-5016 go.mod
HIGH GO-2026-5015 golang.org/x/crypto: GO-2026-5015 go.mod
HIGH GO-2026-5014 golang.org/x/crypto: GO-2026-5014 go.mod
HIGH GO-2026-5013 golang.org/x/crypto: GO-2026-5013 go.mod
HIGH GO-2026-5006 golang.org/x/crypto: GO-2026-5006 go.mod
HIGH GO-2026-5005 golang.org/x/crypto: GO-2026-5005 go.mod
HIGH GO-2022-0646 github.com/aws/aws-sdk-go: GO-2022-0646 go.mod
HIGH GO-2022-0635 github.com/aws/aws-sdk-go: GO-2022-0635 go.mod
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … internal/db/sqlite/db_service.go:192
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … internal/db/sqlite/db_kv.go:33
MED SEC045 [SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data — even … internal/db/sqlite/basedb.go:69
MED SEC091 [SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/Read… cmd/infra/ursrv/serve/serve.go:172
MED SEC091 [SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/Read… cmd/infra/stupgrades/main.go:103
MED SEC091 [SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/Read… cmd/infra/stcrashreceiver/main.go:95
MED DKR002 Dockerfile base image has no explicit tag Dockerfile.ursrv:1
MED DKR002 Dockerfile base image has no explicit tag Dockerfile.stupgrades:1
MED DKR002 Dockerfile base image has no explicit tag Dockerfile.strelaysrv:16
MED DKR002 Dockerfile base image has no explicit tag Dockerfile.strelaypoolsrv:1
MED DKR002 Dockerfile base image has no explicit tag Dockerfile.stdiscosrv:16
MED DKR002 Dockerfile base image has no explicit tag Dockerfile.stcrashreceiver:1
MED DKR007 Docker build context has no .dockerignore .dockerignore
MED DKR002 Dockerfile base image has no explicit tag Dockerfile:29
MED GHSA-vvgj-x9jq-8cj9 github.com/quic-go/quic-go: GHSA-vvgj-x9jq-8cj9 go.mod
MED GHSA-pjcq-xvwq-hhpj github.com/Azure/go-ntlmssp: GHSA-pjcq-xvwq-hhpj go.mod
MED DKR001 Docker final stage has no non-root USER Dockerfile.ursrv:1
MED DKR001 Docker final stage has no non-root USER Dockerfile.stupgrades:1
MED DKR001 Docker final stage has no non-root USER Dockerfile.strelaysrv:16
MED DKR001 Docker final stage has no non-root USER Dockerfile.strelaypoolsrv:1
MED DKR001 Docker final stage has no non-root USER Dockerfile.stdiscosrv:16
MED DKR001 Docker final stage has no non-root USER Dockerfile.stcrashreceiver:1
MED DKR001 Docker final stage has no non-root USER Dockerfile.builder:2
MED DKR001 Docker final stage has no non-root USER Dockerfile:29
MED AGT006 React interval is created without an explicit cleanup gui/default/syncthing/core/syncthingCon…:34
MED AIC004 Suspicious implementation file appears unreferenced internal/db/sqlite/folderdb_update.go:1
MED JRN005 Compliance or security claim is near a placeholder link gui/default/syncthing/folder/editFolder…:101
MED JRN005 Compliance or security claim is near a placeholder link gui/default/syncthing/folder/editFolder…:100
MED JRN005 Compliance or security claim is near a placeholder link gui/default/syncthing/device/editDevice…:102
LOW SEC132 [SEC132] String concat where the language has interpolation (AI style drift): String buil… script/relnotes.go:106
LOW ERR003 [ERR003] Ignored Error (Go): Ignoring error return values. cmd/infra/stupgrades/main.go:155
LOW ERR003 [ERR003] Ignored Error (Go): Ignoring error return values. cmd/infra/stcrashreceiver/util.go:51
LOW ERR003 [ERR003] Ignored Error (Go): Ignoring error return values. cmd/infra/stcrashreceiver/diskstore.go:82
LOW AIC003 Duplicated implementation block across source files test/util.go:230
LOW AIC003 Duplicated implementation block across source files test/util.go:34
LOW AIC003 Duplicated implementation block across source files script/weblatedl.go:1
LOW AIC003 Duplicated implementation block across source files lib/relay/client/methods.go:129
LOW AIC003 Duplicated implementation block across source files lib/fs/copyrangemethod.go:2
LOW AIC003 Duplicated implementation block across source files cmd/syncthing/cli/operations.go:55
LOW AIC003 Duplicated implementation block across source files cmd/stdiscosrv/apisrv.go:380
LOW AIC003 Duplicated implementation block across source files cmd/dev/stwatchfile/main.go:63
LOW AIC002 Source file name looks like an AI patch artifact internal/db/sqlite/folderdb_update.go:1
LOW AIC002 Source file name looks like an AI patch artifact internal/db/sqlite/db_update.go:1
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … gui/default/syncthing/core/eventService…:25
INFO MINED044 [MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger … gui/default/syncthing/core/durationFilt…:62
INFO MINED071 [MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases. cmd/syncthing/perfstats_unix.go:33
INFO MINED071 [MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases. cmd/syncthing/heapprof.go:26
INFO MINED071 [MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases. cmd/syncthing/blockprof.go:24
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… cmd/syncthing/cli/client.go:107
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… cmd/infra/strelaypoolsrv/stats.go:165
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… cmd/dev/stevents/main.go:45
INFO MINED060 [MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks g… cmd/infra/stcrashreceiver/main.go:62
INFO MINED060 [MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks g… cmd/dev/stfinddevice/main.go:99
INFO MINED060 [MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks g… cmd/dev/stdisco/main.go:54
Reset to top 5 191 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `syncthing/syncthing`

**Score: 66/100 (B-)**  ·  191 findings  ·  scanned 2026-06-05 07:18 UTC  ·  125,446 LOC

| Severity | Count |
|---|---|
| CRITICAL | 35 |
| HIGH | 102 |
| MEDIUM | 29 |
| LOW | 14 |

📊 [Full filterable report](https://repobility.com/scan/e2d7c0f7-b692-4ec4-b108-3322fb43d091/)  ·  ![scorecard](https://repobility.com/scan/e2d7c0f7-b692-4ec4-b108-3322fb43d091/report.png?v=1780643925-s2)

### Top findings

1. **CRITICAL** `private-key` — Identified a Private Key, which may compromise cryptographic security and sensitive data e
   `test/h4/key.pem:1`
2. **CRITICAL** `private-key` — Identified a Private Key, which may compromise cryptographic security and sensitive data e
   `test/h4/https-key.pem:1`
3. **CRITICAL** `private-key` — Identified a Private Key, which may compromise cryptographic security and sensitive data e
   `test/h3/https-key.pem:1`
4. **CRITICAL** `private-key` — Identified a Private Key, which may compromise cryptographic security and sensitive data e
   `test/h2/key.pem:1`
5. **CRITICAL** `private-key` — Identified a Private Key, which may compromise cryptographic security and sensitive data e
   `test/h3/key.pem:1`

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/e2d7c0f7-b692-4ec4-b108-3322fb43d091/_
Already filed
This repo publishes a SECURITY.md policy and the scan contains 14 Critical/High security finding(s). Public issue filing would violate coordinated disclosure. Submit privately via the project's security reporting channel.
Megaproject â high spam risk
Could not determine 'syncthing/syncthing' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
I read the warnings â override Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.