{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:25:48.004977Z","repo":{"ref":{"host":"github.com","owner":"koding","name":"kite"},"default_branch":"master","clone_url":"https://github.com/koding/kite.git","html_url":"https://github.com/koding/kite","description":"Micro-service framework in Go","stars":3256,"forks":300,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":4238,"primary_language":"Go","license_spdx":"MIT","created_at":"2014-02-20T21:14:43Z","pushed_at":"2018-10-28T20:12:37Z","security_policy_url":null,"distribution":{"owner_created_at":"2011-09-21T02:58:38Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"baa1a54919e3035417f7571dd46005e91afe8abe","profile":{"lines_by_language":{"Go":15387,"Python":231,"SQL":133,"Shell":13},"files_by_category":{"source":82,"test":23,"config":4,"other":2,"docs":2},"source_lines":12646,"test_lines":3118},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":80.3,"confidence":0.9,"coverage":1.0,"label":"strong","breakdown":{"complexity":91.8,"duplication":86.5,"lint":88.7,"testing":76.7,"docs":65.0,"type_safety":40.0,"process":null},"summary":"Code quality is strong: test-to-source ratio 0.25, CI runs tests; 3% of function code in complex or long functions; 2% duplicated lines. Weakest area: type safety."},"security":{"score":54.7,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":61.7,"sast":63.3,"dependencies":null,"ci_actions":null,"posture":20.0,"scorecard":null},"summary":"Security posture is weak: 1 possible secret(s) in the tree, 0 only in history; 3 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":1616.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":53575.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2013-09":{"loc":6131,"attributed_loc":0},"2013-10":{"loc":5185,"attributed_loc":0},"2013-11":{"loc":6475,"attributed_loc":0},"2013-12":{"loc":2908,"attributed_loc":0},"2014-01":{"loc":4023,"attributed_loc":0},"2014-02":{"loc":6852,"attributed_loc":0},"2014-03":{"loc":1995,"attributed_loc":0},"2014-04":{"loc":1874,"attributed_loc":0},"2014-05":{"loc":1627,"attributed_loc":0},"2014-06":{"loc":1712,"attributed_loc":0},"2014-07":{"loc":1132,"attributed_loc":0},"2014-08":{"loc":1414,"attributed_loc":0},"2014-09":{"loc":83,"attributed_loc":0},"2014-10":{"loc":2319,"attributed_loc":0},"2014-11":{"loc":29,"attributed_loc":0},"2014-12":{"loc":976,"attributed_loc":0},"2015-01":{"loc":250,"attributed_loc":0},"2015-02":{"loc":340,"attributed_loc":0},"2015-03":{"loc":36,"attributed_loc":0},"2015-04":{"loc":21,"attributed_loc":0},"2015-05":{"loc":28,"attributed_loc":0},"2015-06":{"loc":1236,"attributed_loc":0},"2015-07":{"loc":81,"attributed_loc":0},"2015-08":{"loc":54,"attributed_loc":0},"2015-09":{"loc":316,"attributed_loc":0},"2015-10":{"loc":27,"attributed_loc":0},"2015-11":{"loc":62,"attributed_loc":0},"2016-01":{"loc":0,"attributed_loc":0},"2016-02":{"loc":31,"attributed_loc":0},"2016-03":{"loc":31,"attributed_loc":0},"2016-04":{"loc":48,"attributed_loc":0},"2016-05":{"loc":1456,"attributed_loc":0},"2016-06":{"loc":1769,"attributed_loc":0},"2016-07":{"loc":473,"attributed_loc":0},"2016-08":{"loc":578,"attributed_loc":0},"2016-10":{"loc":138,"attributed_loc":0},"2016-11":{"loc":19,"attributed_loc":0},"2016-12":{"loc":2,"attributed_loc":0},"2017-01":{"loc":118,"attributed_loc":0},"2017-03":{"loc":927,"attributed_loc":0},"2017-04":{"loc":0,"attributed_loc":0},"2017-06":{"loc":17,"attributed_loc":0},"2017-09":{"loc":187,"attributed_loc":0},"2017-11":{"loc":169,"attributed_loc":0},"2017-12":{"loc":395,"attributed_loc":0},"2018-01":{"loc":0,"attributed_loc":0},"2018-06":{"loc":31,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":770.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":50608.0,"pre_ai_era_burst_loc":0.0,"measured_loc":50608.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":332.8306190989164,"median_loc_per_hour":48.5,"pr_timed_units":1.0,"excluded_import_loc":2967.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["1e439c3bbfe1f75fb5cff7920fa882a69c5a14d1"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":12646.0,"index":0.079,"count:narrated_steps":1.0,"per_kloc:narrated_steps":0.079,"files:narrated_steps":1.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // now we are ready","ref":"reverseproxy/reverseproxy.go:231","url":"https://github.com/koding/kite/blob/baa1a54919e3035417f7571dd46005e91afe8abe/reverseproxy/reverseproxy.go#L231","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":1.0,"secrets_history":0.0,"secrets_nonprod":2.0,"secrets_low_confidence":0.0},"findings":[{"rule_id":"gitleaks/private-key","severity":"high","message":"Possible private-key secret in the current tree","path":"testkeys/testkeys.go","line":23,"fingerprint":"testkeys/testkeys.go:private-key:23"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 5f02145b7a); removed from the current tree but still retrievable","path":"kontrol/kontrol_test.go","line":19,"fingerprint":"5f02145b7ad9d4d218f687b0ad20e7a470a3a835:kontrol/kontrol_test.go:generic-api-key:19"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 661434140c); removed from the current tree but still retrievable","path":"README.md","line":52,"fingerprint":"661434140c18742f590ade0b314ce438650c819a:README.md:generic-api-key:52"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":39.0,"findings_high":3.0,"findings_medium":36.0,"findings_low":0.0,"weighted_findings":16.35,"scanned_lines":12513.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/go.lang.security.audit.dangerous-syscall-exec","severity":"high","message":"Detected non-static command inside Exec. Audit the input to 'syscall.Exec'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"kitectl/command/run.go","line":86,"fingerprint":"go.lang.security.audit.dangerous-syscall-exec:kitectl/command/run.go:86"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'check_call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"kitectl/release.py","line":169,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:kitectl/release.py:169"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"kitectl/release.py","line":175,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:kitectl/release.py:175"},{"rule_id":"opengrep/go.lang.security.audit.unsafe-reflect-by-name","severity":"medium","message":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to  [confidence low]","path":"dnode/unscrub.go","line":94,"fingerprint":"go.lang.security.audit.unsafe-reflect-by-name:dnode/unscrub.go:94"},{"rule_id":"opengrep/go.lang.security.potential-dos-via-decompression-bomb","severity":"medium","message":"Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. [confidence low]","path":"kitectl/command/install.go","line":232,"fingerprint":"go.lang.security.potential-dos-via-decompression-bomb:kitectl/command/install.go:232"},{"rule_id":"opengrep/python.lang.security.dangerous-globals-use","severity":"medium","message":"Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'. [confidence low]","path":"kitectl/release.py","line":180,"fingerprint":"python.lang.security.dangerous-globals-use:kitectl/release.py:180"},{"rule_id":"opengrep/python.lang.security.dangerous-globals-use","severity":"medium","message":"Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'. [confidence low]","path":"kitectl/release.py","line":209,"fingerprint":"python.lang.security.dangerous-globals-use:kitectl/release.py:209"},{"rule_id":"opengrep/python.lang.security.insecure-hash-algorithm-sha1","severity":"medium","message":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"kitectl/release.py","line":221,"fingerprint":"python.lang.security.insecure-hash-algorithm-sha1:kitectl/release.py:221"},{"rule_id":"opengrep/go.lang.security.audit.crypto.math-random-used","severity":"medium","message":"Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium]","path":"kontrol/kites.go","line":4,"fingerprint":"go.lang.security.audit.crypto.math-random-used:kontrol/kites.go:4"},{"rule_id":"opengrep/go.lang.security.audit.crypto.math-random-used","severity":"medium","message":"Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium]","path":"kontrol/kontrol.go","line":8,"fingerprint":"go.lang.security.audit.crypto.math-random-used:kontrol/kontrol.go:8"},{"rule_id":"opengrep/go.lang.security.audit.crypto.missing-ssl-minversion","severity":"medium","message":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web se [confidence high]","path":"kontrol/kontrol/main.go","line":76,"fingerprint":"go.lang.security.audit.crypto.missing-ssl-minversion:kontrol/kontrol/main.go:76"},{"rule_id":"opengrep/go.lang.security.audit.crypto.math-random-used","severity":"medium","message":"Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium]","path":"kontrolclient.go","line":7,"fingerprint":"go.lang.security.audit.crypto.math-random-used:kontrolclient.go:7"},{"rule_id":"opengrep/go.lang.security.reverseproxy-director","severity":"medium","message":"ReverseProxy can remove headers added by Director. Consider using ReverseProxy.Rewrite instead of ReverseProxy.Director. [confidence medium]","path":"reverseproxy/reverseproxy.go","line":80,"fingerprint":"go.lang.security.reverseproxy-director:reverseproxy/reverseproxy.go:80"},{"rule_id":"opengrep/go.lang.security.shared-url-struct-mutation","severity":"medium","message":"Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low]","path":"reverseproxy/reverseproxy.go","line":174,"fingerprint":"go.lang.security.shared-url-struct-mutation:reverseproxy/reverseproxy.go:174"},{"rule_id":"opengrep/go.lang.security.audit.crypto.missing-ssl-minversion","severity":"medium","message":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web se [confidence high]","path":"reverseproxy/reverseproxy.go","line":220,"fingerprint":"go.lang.security.audit.crypto.missing-ssl-minversion:reverseproxy/reverseproxy.go:220"},{"rule_id":"opengrep/go.lang.security.shared-url-struct-mutation","severity":"medium","message":"Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low]","path":"reverseproxy/reverseproxy/main.go","line":52,"fingerprint":"go.lang.security.shared-url-struct-mutation:reverseproxy/reverseproxy/main.go:52"},{"rule_id":"opengrep/go.lang.security.audit.crypto.missing-ssl-minversion","severity":"medium","message":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web se [confidence high]","path":"server.go","line":128,"fingerprint":"go.lang.security.audit.crypto.missing-ssl-minversion:server.go:128"},{"rule_id":"opengrep/go.lang.security.shared-url-struct-mutation","severity":"medium","message":"Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low]","path":"sockjsclient/sockjsclient.go","line":309,"fingerprint":"go.lang.security.shared-url-struct-mutation:sockjsclient/sockjsclient.go:309"},{"rule_id":"opengrep/go.lang.security.shared-url-struct-mutation","severity":"medium","message":"Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low]","path":"sockjsclient/sockjsclient.go","line":311,"fingerprint":"go.lang.security.shared-url-struct-mutation:sockjsclient/sockjsclient.go:311"},{"rule_id":"opengrep/go.lang.security.shared-url-struct-mutation","severity":"medium","message":"Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low]","path":"sockjsclient/sockjsclient.go","line":316,"fingerprint":"go.lang.security.shared-url-struct-mutation:sockjsclient/sockjsclient.go:316"},{"rule_id":"opengrep/go.lang.security.shared-url-struct-mutation","severity":"medium","message":"Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low]","path":"sockjsclient/sockjsclient.go","line":318,"fingerprint":"go.lang.security.shared-url-struct-mutation:sockjsclient/sockjsclient.go:318"},{"rule_id":"opengrep/go.lang.security.shared-url-struct-mutation","severity":"medium","message":"Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low]","path":"sockjsclient/sockjsclient.go","line":322,"fingerprint":"go.lang.security.shared-url-struct-mutation:sockjsclient/sockjsclient.go:322"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"systeminfo/systeminfo_darwin.go","line":89,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:systeminfo/systeminfo_darwin.go:89"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"systeminfo/systeminfo_openbsd.go","line":36,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:systeminfo/systeminfo_openbsd.go:36"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"systeminfo/systeminfo_openbsd.go","line":38,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:systeminfo/systeminfo_openbsd.go:38"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"systeminfo/systeminfo_openbsd.go","line":38,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:systeminfo/systeminfo_openbsd.go:38"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"systeminfo/systeminfo_openbsd.go","line":38,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:systeminfo/systeminfo_openbsd.go:38"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"systeminfo/systeminfo_openbsd.go","line":67,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:systeminfo/systeminfo_openbsd.go:67"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"systeminfo/systeminfo_openbsd.go","line":69,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:systeminfo/systeminfo_openbsd.go:69"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"systeminfo/systeminfo_openbsd.go","line":69,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:systeminfo/systeminfo_openbsd.go:69"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"systeminfo/systeminfo_openbsd.go","line":69,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:systeminfo/systeminfo_openbsd.go:69"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"systeminfo/systeminfo_windows.go","line":26,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:systeminfo/systeminfo_windows.go:26"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"systeminfo/systeminfo_windows.go","line":27,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:systeminfo/systeminfo_windows.go:27"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"systeminfo/systeminfo_windows.go","line":53,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:systeminfo/systeminfo_windows.go:53"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"systeminfo/systeminfo_windows.go","line":54,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:systeminfo/systeminfo_windows.go:54"},{"rule_id":"opengrep/go.lang.security.shared-url-struct-mutation","severity":"medium","message":"Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low]","path":"tunnelproxy/proxy.go","line":209,"fingerprint":"go.lang.security.shared-url-struct-mutation:tunnelproxy/proxy.go:209"},{"rule_id":"opengrep/go.lang.security.shared-url-struct-mutation","severity":"medium","message":"Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low]","path":"tunnelproxy/proxy.go","line":210,"fingerprint":"go.lang.security.shared-url-struct-mutation:tunnelproxy/proxy.go:210"},{"rule_id":"opengrep/go.lang.security.audit.crypto.math-random-used","severity":"medium","message":"Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium]","path":"utils/utils.go","line":6,"fingerprint":"go.lang.security.audit.crypto.math-random-used:utils/utils.go:6"},{"rule_id":"opengrep/go.lang.security.audit.net.avoid-bind-to-all-interfaces","severity":"medium","message":"Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string. [confidence high]","path":"utils/utils.go","line":53,"fingerprint":"go.lang.security.audit.net.avoid-bind-to-all-interfaces:utils/utils.go:53"}],"evidence":[],"data":{"rulesets":["go","python","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":0.68,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":601.0,"function_nloc":7111.0,"mean_ccn":2.68,"p90_ccn":6.0,"complex_functions":3.0,"long_functions":0.0,"many_param_functions":1.0,"risky_nloc_share":0.0287},"findings":[],"evidence":[{"kind":"complex-function","description":"setCallback in dnode/unscrub.go: complexity 20, 67 lines","ref":"dnode/unscrub.go","url":"https://github.com/koding/kite/blob/baa1a54919e3035417f7571dd46005e91afe8abe/dnode/unscrub.go#L31","weight":0.3333333333333333},{"kind":"complex-function","description":"ServeKite in method.go: complexity 19, 52 lines","ref":"method.go","url":"https://github.com/koding/kite/blob/baa1a54919e3035417f7571dd46005e91afe8abe/method.go#L207","weight":0.31666666666666665},{"kind":"complex-function","description":"watchAndSendKiteEvents in kontrol/_watcher.go: complexity 17, 85 lines","ref":"kontrol/_watcher.go","url":"https://github.com/koding/kite/blob/baa1a54919e3035417f7571dd46005e91afe8abe/kontrol/_watcher.go#L37","weight":0.2833333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":8249.0,"duplicated_lines":200.0,"duplicated_share":0.0242,"files":82.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: examples/exp2-query/exp2-query.go:4 and examples/exp2-watch/exp2-watch.go:8","ref":"examples/exp2-query/exp2-query.go","url":"https://github.com/koding/kite/blob/baa1a54919e3035417f7571dd46005e91afe8abe/examples/exp2-query/exp2-query.go#L4","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/exp2-query/exp2-query.go:36 and examples/exp2/exp2.go:24","ref":"examples/exp2-query/exp2-query.go","url":"https://github.com/koding/kite/blob/baa1a54919e3035417f7571dd46005e91afe8abe/examples/exp2-query/exp2-query.go#L36","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: heartbeat.go:5 and kitectl/command/install.go:6","ref":"heartbeat.go","url":"https://github.com/koding/kite/blob/baa1a54919e3035417f7571dd46005e91afe8abe/heartbeat.go#L5","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: kitectl/command/query.go:78 and protocol/protocol.go:71","ref":"kitectl/command/query.go","url":"https://github.com/koding/kite/blob/baa1a54919e3035417f7571dd46005e91afe8abe/kitectl/command/query.go#L78","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: kontrol/002-table.sql:10 and kontrol/003-migration-001-add-kite-key-table.sql:2","ref":"kontrol/002-table.sql","url":"https://github.com/koding/kite/blob/baa1a54919e3035417f7571dd46005e91afe8abe/kontrol/002-table.sql#L10","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: kontrol/etcd.go:103 and kontrol/etcd.go:141","ref":"kontrol/etcd.go","url":"https://github.com/koding/kite/blob/baa1a54919e3035417f7571dd46005e91afe8abe/kontrol/etcd.go#L103","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: kontrol/etcd.go:207 and kontrol/postgres.go:139","ref":"kontrol/etcd.go","url":"https://github.com/koding/kite/blob/baa1a54919e3035417f7571dd46005e91afe8abe/kontrol/etcd.go#L207","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: kontrol/keypair.go:181 and kontrol/keypair.go:199","ref":"kontrol/keypair.go","url":"https://github.com/koding/kite/blob/baa1a54919e3035417f7571dd46005e91afe8abe/kontrol/keypair.go#L181","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: kontrolclient.go:195 and kontrolclient.go:237","ref":"kontrolclient.go","url":"https://github.com/koding/kite/blob/baa1a54919e3035417f7571dd46005e91afe8abe/kontrolclient.go#L195","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: reverseproxy/reverseproxy.go:25 and tunnelproxy/proxy.go:31","ref":"reverseproxy/reverseproxy.go","url":"https://github.com/koding/kite/blob/baa1a54919e3035417f7571dd46005e91afe8abe/reverseproxy/reverseproxy.go#L25","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":6.0,"weighted_findings":6.0,"scanned_lines":12513.0,"category:best-practice":2.0,"category:correctness":4.0},"findings":[{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"kitectl/command/install.go","line":220,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:kitectl/command/install.go:220"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"kitectl/command/install.go","line":275,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:kitectl/command/install.go:275"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"kitectl/release.py","line":80,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:kitectl/release.py:80"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"kitectl/release.py","line":105,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:kitectl/release.py:105"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"kitekey/kitekey.go","line":71,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:kitekey/kitekey.go:71"},{"rule_id":"opengrep/go.lang.correctness.use-filepath-join","severity":"medium","message":"`path.Join(...)` always joins using a forward slash. This may cause issues on Windows or other systems using a different delimiter. Use `filepath.Join(...)` instead which uses OS-specific path separators.","path":"sockjsclient/sockjsclient.go","line":322,"fingerprint":"go.lang.correctness.use-filepath-join:sockjsclient/sockjsclient.go:322"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.4931,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.9381,"test_lines":3118.0,"source_lines":12646.0,"test_ratio":0.2466,"ci_files":1.0,"cochange_share":0.2345,"cochange_commits":226.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .travis.yml","ref":".travis.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (make test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["make test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":115.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}