https://github.com/CJackHwang/ds2api.git ·
lang: go ·
LOC: ·
source: user_submitted
| Rule | Severity | Count |
|---|---|---|
AIC003 Duplicated implementation block across source files |
low | 30 |
MINED115 GitHub Action pinned to mutable ref (not 40-char SHA) |
high | 17 |
AUC004 [AUC004] Admin route does not show super_admin separation: … |
medium | 10 |
AUC009 [AUC009] Sensitive function route lacks elevated authorizat… |
medium | 10 |
AUC003 [AUC003] Object-level route lacks visible authorization: A … |
high | 10 |
ERR003 [ERR003] Ignored Error (Go): Ignoring error return values. |
medium | 4 |
MINED044 Js Console Log Prod |
info | 4 |
MINED118 Dockerfile FROM not pinned by sha256 digest |
high | 4 |
MINED060 Go Context No Cancel |
info | 4 |
SEC029 Server-Side Request Forgery (SSRF) — outbound HTTP from use… |
high | 4 |
AUC003
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/httpapi/admin/history/routes.go:7
· conf 0.70
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. End…AUC003
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/httpapi/admin/history/routes.go:9
· conf 0.70
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. End…AUC003
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/httpapi/admin/proxies/routes.go:12
· conf 0.70
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. End…AUC003
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/httpapi/admin/proxies/routes.go:13
· conf 0.70
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. End…AUC003
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/server/router.go:100
· conf 0.70
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. End…AUC003
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/server/router.go:103
· conf 0.70
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. End…AUC003
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/server/router.go:105
· conf 0.70
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. End…AUC003
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/server/router.go:109
· conf 0.70
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. End…AUC003
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/server/router.go:112
· conf 0.70
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. End…AUC003
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/server/router.go:114
· conf 0.70
[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. End…JRN009
Secret-like setting is echoed into a password input value
webui/src/features/account/AddAccountModal.jsx:68
· conf 0.83
Secret-like setting is echoed into a password input valueJRN009
Secret-like setting is echoed into a password input value
webui/src/features/proxy/ProxyManagerContainer.jsx:269
· conf 0.83
Secret-like setting is echoed into a password input valueMINED004
Weak Crypto
CWE-327
internal/config/config.go:4
· conf 1.00
[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).MINED004
Weak Crypto
CWE-327
internal/httpapi/admin/shared/helpers.go:4
· conf 1.00
[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).MINED004
Weak Crypto
CWE-327
internal/httpapi/admin/vercel/handler_vercel.go:6
· conf 1.00
[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/quality-gates.yml:28
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/quality-gates.yml:31
· conf 0.90
[MINED115] Action `actions/setup-go` pinned to mutable ref `@v5`: `uses: actions/setup-go@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/quality-gates.yml:37
· conf 0.90
[MINED115] Action `golangci/golangci-lint-action` pinned to mutable ref `@v8`: `uses: golangci/golangci-lint-action@v8` resolves at workflow-run time. Tags and branches can be re-pushed by the action…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/quality-gates.yml:63
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/quality-gates.yml:66
· conf 0.90
[MINED115] Action `actions/setup-go` pinned to mutable ref `@v5`: `uses: actions/setup-go@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/quality-gates.yml:79
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/quality-gates.yml:82
· conf 0.90
[MINED115] Action `actions/setup-go` pinned to mutable ref `@v5`: `uses: actions/setup-go@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/quality-gates.yml:88
· conf 0.90
[MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-node@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the …MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/quality-gates.yml:102
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/quality-gates.yml:105
· conf 0.90
[MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-node@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the …MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/quality-gates.yml:122
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/quality-gates.yml:125
· conf 0.90
[MINED115] Action `actions/setup-go` pinned to mutable ref `@v5`: `uses: actions/setup-go@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release-artifacts.yml:33
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release-artifacts.yml:36
· conf 0.90
[MINED115] Action `actions/setup-go` pinned to mutable ref `@v5`: `uses: actions/setup-go@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release-artifacts.yml:42
· conf 0.90
[MINED115] Action `actions/setup-node` pinned to mutable ref `@v4`: `uses: actions/setup-node@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the …MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release-dockerhub.yml:24
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v5`: `uses: actions/checkout@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED115
GitHub Action pinned to mutable ref (not 40-char SHA)
CWE-829
.github/workflows/release.yml:24
· conf 0.90
[MINED115] Action `actions/checkout` pinned to mutable ref `@v5`: `uses: actions/checkout@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-a…MINED118
Dockerfile FROM not pinned by sha256 digest
CWE-829
Dockerfile:1
· conf 0.90
[MINED118] Dockerfile FROM `node:24` not pinned by digest: `FROM node:24` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially di…MINED118
Dockerfile FROM not pinned by sha256 digest
CWE-829
Dockerfile:9
· conf 0.90
[MINED118] Dockerfile FROM `golang:1.26` not pinned by digest: `FROM golang:1.26` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potent…MINED118
Dockerfile FROM not pinned by sha256 digest
CWE-829
Dockerfile:24
· conf 0.90
[MINED118] Dockerfile FROM `busybox:1.36.1-musl` not pinned by digest: `FROM busybox:1.36.1-musl` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every…MINED118
Dockerfile FROM not pinned by sha256 digest
CWE-829
Dockerfile:26
· conf 0.90
[MINED118] Dockerfile FROM `debian:bookworm-slim` not pinned by digest: `FROM debian:bookworm-slim` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so eve…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
internal/js/chat-stream/http_internal.js:35
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
internal/js/chat-stream/proxy_go.js:10
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
internal/sse/citation_links.go:108
· conf 1.00
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.25…SEC093
Go: exec.Command with non-literal
internal/testsuite/runner_env.go:90
· conf 1.00
[SEC093] Go: exec.Command with non-literal: exec.Command(<var>) — variable command name allows command injection. Ported from gosec G204 (Apache-2.0).SEC093
Go: exec.Command with non-literal
internal/webui/build.go:79
· conf 1.00
[SEC093] Go: exec.Command with non-literal: exec.Command(<var>) — variable command name allows command injection. Ported from gosec G204 (Apache-2.0).SEC114
path.join / Path() on user-controlled segment without containment check
internal/testsuite/runner_http.go:150
· conf 1.00
[SEC114] path.join / Path() on user-controlled segment without containment check: filepath.Clean / path.Join on attacker-supplied segments does NOT prevent escape from the base directory. `../../../e…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
internal/httpapi/admin/accounts/routes.go:16
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
internal/httpapi/admin/configmgmt/routes.go:17
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…SEC128
Async function without await — fire-and-forget Promise (AI mistake)
internal/httpapi/admin/devcapture/routes.go:7
· conf 1.00
[SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work comple…AUC001
[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.
[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.AUC002
[AUC002] Low visible authorization coverage in route inventory: Only 0.0% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.
[AUC002] Low visible authorization coverage in route inventory: Only 19.5% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence.AUC004
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/auth/admin.go:148
· conf 0.66
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin acc…AUC004
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/httpapi/admin/auth/handler_auth.go:44
· conf 0.66
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin acc…AUC004
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/httpapi/admin/auth/routes.go:14
· conf 0.66
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin acc…AUC004
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/httpapi/admin/auth/routes.go:15
· conf 0.66
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin acc…AUC004
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/httpapi/admin/history/routes.go:10
· conf 0.66
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin acc…AUC004
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/httpapi/admin/settings/routes.go:10
· conf 0.66
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin acc…AUC004
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/server/router.go:114
· conf 0.66
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin acc…AUC004
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/server/router.go:115
· conf 0.66
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin acc…AUC004
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/webui/handler.go:28
· conf 0.66
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin acc…AUC004
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: ANY /plugins/<slug:plugin_slug>/.
internal/webui/handler.go:29
· conf 0.66
[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin acc…AUC009
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /items/{item_id}.
internal/auth/request.go:73
· conf 0.68
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without el…AUC009
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /items/{item_id}.
internal/auth/request.go:231
· conf 0.68
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without el…AUC009
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /items/{item_id}.
internal/auth/request.go:238
· conf 0.68
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without el…AUC009
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /items/{item_id}.
internal/auth/request.go:247
· conf 0.68
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without el…AUC009
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /items/{item_id}.
internal/auth/request.go:250
· conf 0.68
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without el…AUC009
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /items/{item_id}.
internal/httpapi/claude/handler_routes.go:38
· conf 0.68
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without el…AUC009
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /items/{item_id}.
internal/httpapi/claude/handler_routes.go:39
· conf 0.68
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without el…AUC009
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /items/{item_id}.
internal/httpapi/claude/handler_routes.go:40
· conf 0.68
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without el…AUC009
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /items/{item_id}.
internal/server/router.go:291
· conf 0.68
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without el…AUC009
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: DELETE /items/{item_id}.
internal/server/router.go:302
· conf 0.68
[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without el…DKR001
Docker final stage has no non-root USER
Dockerfile:70
· conf 0.82
Docker final stage has no non-root USERDKR003
Dockerfile base image uses the latest tag
docker-compose.yml:1
· conf 0.94
Compose service `ds2api` image uses the latest tagDKR014
Dockerfile copies the entire context without .dockerignore
Dockerfile:17
· conf 0.76
Dockerfile copies broad context with incomplete .dockerignoreERR002
[ERR002] Empty Catch Block: Empty catch blocks hide errors.
webui/src/features/apiTester/useChatStreamClient.js:210
· conf 1.00
[ERR002] Empty Catch Block: Empty catch blocks hide errors.JRN002
Browser storage is used for session token material
webui/src/app/useAdminAuth.js:37
· conf 0.82
Browser storage is used for session token materialJRN002
Browser storage is used for session token material
webui/src/app/useAdminAuth.js:38
· conf 0.82
Browser storage is used for session token materialSEC041
Tabnabbing — target="_blank" without rel="noopener noreferrer"
internal/webui/handler.go:17
· conf 1.00
[SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blank"> without rel="noopener noreferrer" leaks window.opener to the opened page. The opened page can then run win…SEC041
Tabnabbing — target="_blank" without rel="noopener noreferrer"
webui/src/components/LandingPage.jsx:109
· conf 1.00
[SEC041] Tabnabbing — target="_blank" without rel="noopener noreferrer": <a target="_blank"> without rel="noopener noreferrer" leaks window.opener to the opened page. The opened page can then run win…SEC091
Go: net/http server without timeouts
cmd/ds2api/main.go:37
· conf 1.00
[SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/ReadTimeout/WriteTimeout is vulnerable to Slowloris. Ported from gosec G112 + G114 (Apache-2.0).SEC134
AI scaffold leftover — Lorem ipsum / example.com / John Doe in code
webui/src/features/account/AddAccountModal.jsx:51
· conf 1.00
[SEC134] AI scaffold leftover — Lorem ipsum / example.com / John Doe in code: Lorem ipsum / John Doe / example.com left in non-test code. AI agents emit these as 'reasonable defaults' when they don't…AIC003
Duplicated implementation block across source files
internal/deepseek/client/client_session_delete.go:48
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/deepseek/client/client_session_delete.go:50
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/deepseek/client/client_session.go:69
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/admin/configmgmt/deps.go:3
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/admin/devcapture/deps.go:2
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/admin/history/deps.go:2
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/admin/proxies/deps.go:2
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/admin/proxies/deps.go:3
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/admin/settings/deps.go:2
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/admin/settings/deps.go:3
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/admin/vercel/deps.go:2
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/admin/vercel/handler_vercel.go:293
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/admin/version/deps.go:2
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/claude/stream_runtime_finalize.go:82
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/gemini/convert_messages.go:265
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/gemini/deps.go:2
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/gemini/handler_generate.go:159
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/gemini/handler_routes.go:6
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/gemini/handler_stream_runtime.go:193
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/openai/responses/handler.go:24
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/openai/responses/responses_handler.go:64
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/openai/responses/responses_handler.go:204
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/httpapi/openai/responses/responses_stream_runtime_core.go:155
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/js/chat-stream/http_internal.js:199
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/js/chat-stream/sse_parse_impl.js:582
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/js/chat-stream/toolcall_policy.js:116
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/js/helpers/stream-tool-sieve/format.js:200
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/js/helpers/stream-tool-sieve/state.js:79
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/prompt/tool_calls.go:54
· conf 0.86
Duplicated implementation block across source filesAIC003
Duplicated implementation block across source files
internal/responsehistory/session.go:77
· conf 0.86
Duplicated implementation block across source filesDKC006
Compose service does not declare a runtime user
docker-compose.yml:1
· conf 0.56
Compose service does not declare a runtime userDKC010
Compose service lacks no-new-privileges hardening
docker-compose.yml:1
· conf 0.62
Compose service lacks no-new-privileges hardeningDKR008
.dockerignore misses sensitive defaults
.dockerignore
· conf 0.72
.dockerignore misses sensitive defaultsERR003
[ERR003] Ignored Error (Go): Ignoring error return values.
cmd/ds2api/main.go:26
· conf 1.00
[ERR003] Ignored Error (Go): Ignoring error return values.ERR003
[ERR003] Ignored Error (Go): Ignoring error return values.
cmd/ds2api-tests/main.go:33
· conf 1.00
[ERR003] Ignored Error (Go): Ignoring error return values.ERR003
[ERR003] Ignored Error (Go): Ignoring error return values.
internal/auth/admin.go:215
· conf 1.00
[ERR003] Ignored Error (Go): Ignoring error return values.SEC132
String concat where the language has interpolation (AI style drift)
internal/httpapi/admin/vercel/handler_vercel.go:169
· conf 1.00
[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template liter…SEC132
String concat where the language has interpolation (AI style drift)
internal/httpapi/claude/handler_utils.go:131
· conf 1.00
[SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template liter…ERR003
[ERR003] Ignored Error (Go): Ignoring error return values.
[ERR003] Ignored Error (Go) (and 25 more): Same pattern found in 25 additional files. Review if needed.MINED043
Http Not Https
CWE-319
cmd/ds2api/main.go:46
· conf 1.00
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.MINED043
Http Not Https
CWE-319
internal/sse/citation_links.go:162
· conf 1.00
[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.MINED044
Js Console Log Prod
CWE-532
[MINED044] Js Console Log Prod (and 2 more): Same pattern found in 2 additional files. Review if needed.MINED044
Js Console Log Prod
CWE-532
webui/src/app/useAdminConfig.js:24
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED044
Js Console Log Prod
CWE-532
webui/src/features/account/useAccountsData.js:35
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED044
Js Console Log Prod
CWE-532
webui/src/features/apiTester/useChatStreamClient.js:204
· conf 1.00
[MINED044] Js Console Log Prod: console.log left in code. Should be replaced with logger or removed.MINED056
React Key As Index
CWE-682
webui/src/components/LandingPage.jsx:132
· conf 1.00
[MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.MINED056
React Key As Index
CWE-682
webui/src/features/account/ApiKeysPanel.jsx:99
· conf 1.00
[MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.MINED056
React Key As Index
CWE-682
webui/src/features/apiTester/ConfigPanel.jsx:158
· conf 1.00
[MINED056] React Key As Index: key={index} in map() — re-renders the wrong elements on re-order.MINED058
React Dangerously Set Html
CWE-79
webui/src/components/LandingPage.jsx:11
· conf 1.00
[MINED058] React Dangerously Set Html: dangerouslySetInnerHTML bypasses Reacts JSX escaping. Pair with DOMPurify or never use with user data.MINED060
Go Context No Cancel
CWE-401
[MINED060] Go Context No Cancel (and 4 more): Same pattern found in 4 additional files. Review if needed.MINED060
Go Context No Cancel
CWE-401
cmd/ds2api/main.go:70
· conf 1.00
[MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks goroutines.MINED060
Go Context No Cancel
CWE-401
cmd/ds2api-tests/main.go:32
· conf 1.00
[MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks goroutines.MINED060
Go Context No Cancel
CWE-401
internal/account/pool_acquire.go:17
· conf 1.00
[MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks goroutines.MINED071
Go Panic Call
CWE-755
internal/deepseek/protocol/constants.go:73
· conf 1.00
[MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases.MINED100
React Index As Key
webui/src/features/apiTester/ConfigPanel.jsx:154
· conf 1.00
[MINED100] React Index As Key: Using the loop index `i` as React `key` causes re-render bugs when the list re-orders, items are inserted/removed mid-list, or items have state. Prefer a stable unique …SEC020
Secret Printed to Logs
internal/auth/request.go:170
· conf 0.10
[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…SEC020
Secret Printed to Logs
internal/deepseek/client/client_auth.go:75
· conf 0.10
[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…SEC020
Secret Printed to Logs
internal/deepseek/client/client_session_delete.go:148
· conf 0.10
[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for tro…SEC029
Server-Side Request Forgery (SSRF) — outbound HTTP from user input
[SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input (and 1 more): Same pattern found in 1 additional files. Review if needed.SEC118
UUIDv1 / UUIDv3 used for security-sensitive identifier
internal/js/chat-stream/toolcall_policy.js:122
· conf 0.10
[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier: UUIDv1 encodes the MAC address and timestamp, making it predictable. Used as a session token or password-reset key, it's enumerable.SEC118
UUIDv1 / UUIDv3 used for security-sensitive identifier
internal/js/helpers/stream-tool-sieve/format.js:224
· conf 0.10
[SEC118] UUIDv1 / UUIDv3 used for security-sensitive identifier: UUIDv1 encodes the MAC address and timestamp, making it predictable. Used as a session token or password-reset key, it's enumerable.SEC128
Async function without await — fire-and-forget Promise (AI mistake)
[SEC128] Async function without await — fire-and-forget Promise (AI mistake) (and 2 more): Same pattern found in 2 additional files. Review if needed.Reading from rp.scan + rp.finding + rp.rule (unified schema, R78 series). Legacy data path unchanged. Compare with /scan/7754021f-50b9-4416-9f65-4f7e38264c3b/.