Home / ghostunnel / ghostunnel
AI Slop Code RIsk Monitor

ghostunnel/ghostunnel

A simple TLS proxy with mutual authentication for securing non-TLS services.

13.1 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for ghostunnel/ghostunnel, a Go project with 2,207 GitHub stars. SynthScan examined 50,959 lines of code across 412 source files, recording 242 pattern matches distributed across 10 syntactic categories. The legacy adjusted pattern signal is 13.1 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

13.1
Adjusted Signal
13.1
Raw Pattern Score
100%
Time Factor
2026-10-01
Last Push
2.2K
Stars
Go
Language
51.0K
Lines of Code
412
Files
242
Pattern Hits
2026-10-12
Scan Date
0.24
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 6.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 57 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.6/100 · LOW

Are imports declared and package/API names verified? 6 finding(s).

Agent Over-Engineering Ratio 44.5/100 · MEDIUM

Are wrappers, guards, and repeated structures necessary? 189 finding(s).

PR Review Velocity Impact 53.3/100 · HIGH

Which changes need focused human review? 242 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 98MEDIUM 22LOW 122

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 242 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Empty Error Handlers74 hits · 370 pts
SeverityFileLineSnippetContext
HIGHtests/test-server-shutdown-timeout.py43except Exception:CODE
HIGHtests/test-server-connection-churn.py56except OSError:CODE
HIGHtests/test-server-idle-reaper.py144except Exception:CODE
HIGHtests/test-server-semaphore-churn.py176except OSError:CODE
HIGHtests/test-server-semaphore-churn.py164except OSError:CODE
HIGHtests/test-server-semaphore-churn.py56except OSError:CODE
HIGHtests/test-server-large-transfer.py166except OSError:CODE
HIGHtests/test-server-large-transfer.py101except (ssl.SSLWantReadError, ssl.SSLWantWriteError):CODE
HIGHtests/test-server-large-transfer.py114except (ssl.SSLWantReadError, ssl.SSLWantWriteError):CODE
HIGHtests/test-server-quiet-handshake-errs.py56except Exception:CODE
HIGHtests/test-server-quiet-handshake-errs.py65except ssl.SSLError:CODE
HIGHtests/test-server-quiet-handshake-errs.py67except OSError:CODE
HIGHtests/test-service-graceful-shutdown.py56except http.client.RemoteDisconnected:CODE
HIGHtests/test-service-graceful-shutdown.py68except Exception:CODE
HIGHtests/test-server-backend-flapping.py99except (ssl.SSLError, ConnectionResetError, BrokenPipeError, OSError):CODE
HIGHtests/test-server-backend-flapping.py119except (ssl.SSLError, ConnectionResetError, BrokenPipeError, OSError):CODE
HIGHtests/test-service-lifecycle.py113except Exception:CODE
HIGHtests/test-service-eventlog-source.py45except Exception:CODE
HIGHtests/test-service-install-duplicate.py77except Exception:CODE
HIGHtests/test-service-install-duplicate.py84except Exception:CODE
HIGHtests/test-server-opa-slow-policy.py105except Exception:CODE
HIGHtests/test-client-shutdown-timeout.py42except Exception:CODE
HIGHtests/test-server-landlock-ssl-cert-file.py75except Exception:CODE
HIGHtests/test-server-abortive-close.py131except (ConnectionError, ssl.SSLError, OSError):CODE
HIGHtests/test-server-abortive-close.py136except OSError:CODE
HIGHtests/test-server-abortive-close.py71except OSError:CODE
HIGHtests/test-server-quiet-conn-errs.py72except Exception:CODE
HIGHtests/test-server-quiet-conn-errs.py57except Exception:CODE
HIGHtests/test-client-via-http-connect-proxy.py49except Exception:CODE
HIGHtests/test-server-tiny-writes.py98except (ssl.SSLWantReadError, ssl.SSLWantWriteError):CODE
HIGHtests/test-server-tiny-writes.py111except (ssl.SSLWantReadError, ssl.SSLWantWriteError):CODE
HIGHtests/test-server-full-duplex-transfer.py176except OSError:CODE
HIGHtests/test-server-full-duplex-transfer.py107except (ssl.SSLWantReadError, ssl.SSLWantWriteError):CODE
HIGHtests/test-server-full-duplex-transfer.py120except (ssl.SSLWantReadError, ssl.SSLWantWriteError):CODE
HIGHtests/test-server-max-concurrent-conns.py81except OSError:CODE
HIGHtests/test-server-max-concurrent-conns.py111except Exception:CODE
HIGHtests/test-client-shutdown-http.py40except http.client.RemoteDisconnected:CODE
HIGHtests/test-client-shutdown-http.py47except Exception:CODE
HIGHtests/test-service-scm-graceful-shutdown.py63except Exception:CODE
HIGHtests/test-server-acme-tls-alpn-renewal.py182except OSError:CODE
HIGHtests/test-server-acme-tls-alpn-renewal.py250except OSError:CODE
HIGHtests/test-server-acme-tls-alpn-renewal.py95except OSError:CODE
HIGHtests/test-server-acme-tls-alpn-renewal.py168except OSError:CODE
HIGHtests/test-server-acme-tls-alpn-renewal.py225except OSError:CODE
HIGHtests/common.py139except Exception:CODE
HIGHtests/common.py214except Exception:CODE
HIGHtests/common.py733except OSError:CODE
HIGHtests/common.py795except OSError:CODE
HIGHtests/common.py406except OSError:CODE
HIGHtests/common.py420except OSError:CODE
HIGHtests/common.py424except OSError:CODE
HIGHtests/common.py205except Exception:CODE
HIGHtests/common.py437except OSError:CODE
HIGHtests/common.py512except OSError:CODE
HIGHtests/test-service-start-stop.py123except Exception:CODE
HIGHtests/test-service-start-stop.py130except Exception:CODE
HIGHtests/test-service-foreign-start-stop.py69except Exception:CODE
HIGHtests/test-server-shutdown-sigterm.py42except Exception:CODE
HIGHtests/test-server-systemd-watchdog.py156except OSError:CODE
HIGHtests/test-server-systemd-watchdog.py161except OSError:CODE
14 more matches not shown…
Cross-File Repetition24 hits · 120 pts
SeverityFileLineSnippetContext
HIGH…s/test-server-handles-client-closes-connection-unix.py0ensures when server disconnects that the client connection also disconnects, with unix sockets.STRING
HIGH…s/test-client-handles-client-closes-connection-unix.py0ensures when server disconnects that the client connection also disconnects, with unix sockets.STRING
HIGH…s/test-server-handles-server-closes-connection-unix.py0ensures when server disconnects that the client connection also disconnects, with unix sockets.STRING
HIGH…s/test-client-handles-server-closes-connection-unix.py0ensures when server disconnects that the client connection also disconnects, with unix sockets.STRING
HIGHtests/test-client-handles-client-closes-connection.py0ensures when server disconnects that the client connection also disconnects.STRING
HIGHtests/test-server-handles-client-closes-connection.py0ensures when server disconnects that the client connection also disconnects.STRING
HIGHtests/test-client-handles-server-closes-connection.py0ensures when server disconnects that the client connection also disconnects.STRING
HIGHtests/test-server-handles-server-closes-connection.py0ensures when server disconnects that the client connection also disconnects.STRING
HIGHtests/test-server-large-transfer.py0full-duplex send+receive on one ssl socket from a single thread. note: concurrent ssl_read/ssl_write on the same ssl objSTRING
HIGHtests/test-server-tiny-writes.py0full-duplex send+receive on one ssl socket from a single thread. note: concurrent ssl_read/ssl_write on the same ssl objSTRING
HIGHtests/test-server-full-duplex-transfer.py0full-duplex send+receive on one ssl socket from a single thread. note: concurrent ssl_read/ssl_write on the same ssl objSTRING
HIGHtests/test-client-reload-broken-certificate.py0ensures that tunnel sees & reloads certificate changes. there are various cases to take into account: - tunnel picks up STRING
HIGHtests/test-client-auto-reload-certificate.py0ensures that tunnel sees & reloads certificate changes. there are various cases to take into account: - tunnel picks up STRING
HIGHtests/test-client-reloads-keystore.py0ensures that tunnel sees & reloads certificate changes. there are various cases to take into account: - tunnel picks up STRING
HIGHtests/test-service-lifecycle.py0run a ghostunnel service subcommand and return (returncode, stdout, stderr).STRING
HIGHtests/test-service-install-duplicate.py0run a ghostunnel service subcommand and return (returncode, stdout, stderr).STRING
HIGHtests/test-service-start-stop.py0run a ghostunnel service subcommand and return (returncode, stdout, stderr).STRING
HIGHtests/test-server-auto-reload-certificate.py0ensures that tunnel sees & reloads a certificate change.STRING
HIGHtests/test-server-reloads-keystore.py0ensures that tunnel sees & reloads a certificate change.STRING
HIGHtests/test-server-reload-broken-certificate.py0ensures that tunnel sees & reloads a certificate change.STRING
HIGHtests/test-server-reloads-split-cert-key.py0ensures that tunnel sees & reloads a certificate change.STRING
HIGHtests/test-client-systemd-socket-activation-error.py0spins up a client and tests systemd socket activation.STRING
HIGHtests/test-client-launchd-socket-activation-error.py0spins up a client and tests systemd socket activation.STRING
HIGHtests/test-client-systemd-socket-activation.py0spins up a client and tests systemd socket activation.STRING
Excessive Try-Catch Wrapping73 hits · 76 pts
SeverityFileLineSnippetContext
LOWtests/test-server-max-tls-version.py55 except Exception:CODE
LOWtests/test-server-shutdown-timeout.py43 except Exception:CODE
LOWtests/test-server-connection-churn.py52 except Exception as e:CODE
LOWtests/test-server-connection-churn.py85 except Exception as e:CODE
LOWtests/test-server-connection-churn.py101 except Exception as e:CODE
LOWtests/test-server-idle-reaper.py46 except Exception as e:CODE
LOWtests/test-server-idle-reaper.py65 except Exception as e:CODE
LOWtests/test-server-idle-reaper.py144 except Exception:CODE
LOWtests/test-server-semaphore-churn.py52 except Exception as e:CODE
LOWtests/test-server-semaphore-churn.py100 except Exception as e:CODE
LOWtests/test-server-quiet-handshake-errs.py56 except Exception:CODE
LOWtests/test-service-graceful-shutdown.py68 except Exception:CODE
LOWtests/test-server-backend-flapping.py140 except Exception as e:CODE
LOWtests/test-server-backend-flapping.py160 except Exception as e:CODE
LOWtests/test-service-lifecycle.py113 except Exception:CODE
LOWtests/test-server-keychain-identity-windows.py39 except Exception as e:CODE
LOWtests/test-service-eventlog-source.py45 except Exception:CODE
MEDIUMtests/test-service-eventlog-source.py39def uninstall_quietly():CODE
LOWtests/test-service-install-duplicate.py77 except Exception:CODE
LOWtests/test-service-install-duplicate.py84 except Exception:CODE
LOWtests/test-server-opa-slow-policy.py105 except Exception:CODE
LOWtests/test-client-shutdown-timeout.py42 except Exception:CODE
LOWtests/test-server-landlock-ssl-cert-file.py75 except Exception:CODE
LOWtests/test-server-abortive-close.py67 except Exception as e:CODE
LOWtests/test-server-quiet-conn-errs.py57 except Exception:CODE
LOWtests/test-server-quiet-conn-errs.py60 except Exception as e:CODE
LOWtests/test-server-quiet-conn-errs.py72 except Exception:CODE
LOWtests/test-client-via-http-connect-proxy.py49 except Exception:CODE
LOWtests/test-server-full-duplex-transfer.py160 except Exception as e:CODE
LOWtests/test-server-full-duplex-transfer.py220 except Exception as e:CODE
MEDIUMtests/test-server-full-duplex-transfer.py157def reader():CODE
MEDIUMtests/test-server-full-duplex-transfer.py217def parallel_client(conn_id):CODE
LOWtests/test-server-max-concurrent-conns.py106 except Exception as exc:CODE
LOWtests/test-server-max-concurrent-conns.py111 except Exception:CODE
LOWtests/test-client-shutdown-http.py47 except Exception:CODE
LOWtests/test-service-scm-graceful-shutdown.py63 except Exception:CODE
LOWtests/test-service-scm-graceful-shutdown.py128 except Exception as exc:CODE
MEDIUMtests/test-service-scm-graceful-shutdown.py57def uninstall_quietly():CODE
MEDIUMtests/test-service-scm-graceful-shutdown.py123def do_stop():CODE
MEDIUMtests/common.py397def _run_handler(self, conn):CODE
LOWtests/common.py139 except Exception:CODE
LOWtests/common.py205 except Exception:CODE
LOWtests/common.py214 except Exception:CODE
LOWtests/common.py231 except Exception as e:CODE
LOWtests/common.py257 except Exception as e:CODE
LOWtests/common.py274 except Exception as e:CODE
LOWtests/common.py401 except Exception as e:CODE
LOWtests/common.py612 except Exception:CODE
LOWtests/common.py716 except Exception:CODE
LOWtests/common.py885 except Exception as e:CODE
LOWtests/common.py957 except Exception as e:CODE
LOWtests/common.py1038 except Exception as e:CODE
LOWtests/common.py1244 except Exception as e:CODE
LOWtests/test-service-start-stop.py123 except Exception:CODE
LOWtests/test-service-start-stop.py130 except Exception:CODE
LOWtests/test-service-foreign-start-stop.py69 except Exception:CODE
LOWtests/test-server-shutdown-sigterm.py42 except Exception:CODE
LOWtests/test-server-shutdown-drains-under-load.py93 except Exception as e:CODE
MEDIUMtests/test-server-shutdown-drains-under-load.py61def _run(self):CODE
LOWtests/test-client-shutdown-sigterm.py41 except Exception:CODE
13 more matches not shown…
Over-Commented Block31 hits · 31 pts
SeverityFileLineSnippetContext
LOWwindows_service.go41COMMENT
LOWlandlock_linux.go81 // exact set of files required in every conceivable situation.COMMENT
LOWlandlock_linux.go241}COMMENT
LOWtls.go141// The ALPN extension encodes each name with a one-byte length prefix (RFC 7301),COMMENT
LOWmain.go701COMMENT
LOWwindows.go101// isRunningAsService reports whether the process was started by the WindowsCOMMENT
LOWproxy/churn_bench_test.go81// -cpu=1,4,8 to observe how the per-connection accept path scales across cores.COMMENT
LOWproxy/churn_bench_test.go101// all unset, the default). Comparing it against BenchmarkConnectionChurnCOMMENT
LOWproxy/proxy.go161 // Enable HAproxy's PROXY protocolCOMMENT
LOWproxy/proxy.go621 //COMMENT
LOWauth/auth.go61COMMENT
LOWauth/auth.go81COMMENT
LOWauth/auth.go161}COMMENT
LOWauth/doc.go1// Package auth provides methods to perform authorization on incoming orCOMMENT
LOWcertstore/certstore_windows.go61COMMENT
LOWtests/test-client-verify-spki-pin.py41 pair.validate_can_send_from_server("world", "pin-matched server -> client")COMMENT
LOWtests/test-server-landlock-ssl-cert-file.py81 """Variant 1: server without --cacert; rely on SSL_CERT_FILE."""COMMENT
LOWtests/test-server-acme-tls-alpn-renewal.py101 raise TimeoutError(COMMENT
LOWtests/test-server-acme-tls-alpn-renewal.py321 ])COMMENT
LOWtests/test-server-acme-tls-alpn-renewal.py381COMMENT
LOWtests/test-client-socks5-proxy.py1#!/usr/bin/env python3COMMENT
LOWwildcard/matcher.go21// We expose functions to build matchers from simple wildcard patterns. EachCOMMENT
LOWcertloader/acmetlsconfig.go81 // certs. If the desired goal is for ghostunnel to use the ACME CAs testCOMMENT
LOWcertloader/acmetlsconfig.go261// repeated builds never alias or grow the base config's NextProtos.COMMENT
LOWcertloader/acmetlsconfig.go281 // Tightening to prevent mTLS bypass — mirror certmagic's own gate atCOMMENT
LOWcertloader/spiffe_tls_config.go121COMMENT
LOWcertloader/certtlsconfig.go1package certloaderCOMMENT
LOWcertloader/tlsconfig.go21)COMMENT
LOWcertloader/doc.go1// Package certloader provides abstractions over certificates that can be usedCOMMENT
LOWsocket/net.go81 https = trueCOMMENT
LOWsocket/doc.go1// Package socket provides method for parsing addresses and openingCOMMENT
Decorative Section Separators8 hits · 24 pts
SeverityFileLineSnippetContext
MEDIUMtests/test-server-acme-tls-alpn-renewal.py334 # -----------------------------------------------------------------COMMENT
MEDIUMtests/test-server-acme-tls-alpn-renewal.py339 # -----------------------------------------------------------------COMMENT
MEDIUMtests/test-server-acme-tls-alpn-renewal.py353 # -----------------------------------------------------------------COMMENT
MEDIUMtests/test-server-acme-tls-alpn-renewal.py358 # -----------------------------------------------------------------COMMENT
MEDIUMtests/test-server-acme-tls-alpn-renewal.py382 # -----------------------------------------------------------------COMMENT
MEDIUMtests/test-server-acme-tls-alpn-renewal.py399 # -----------------------------------------------------------------COMMENT
MEDIUMtests/test-server-acme-tls-alpn-renewal.py421 # -----------------------------------------------------------------COMMENT
MEDIUMtests/test-server-acme-tls-alpn-renewal.py423 # -----------------------------------------------------------------COMMENT
Hyper-Verbose Identifiers10 hits · 10 pts
SeverityFileLineSnippetContext
LOWtests/test-server-acme-tls-alpn-renewal.py76def wait_for_ghostunnel_listener(port, client_cert, timeout=60):CODE
LOWtests/test-server-acme-tls-alpn-renewal.py234def fetch_server_cert_fingerprint(port, client_cert):CODE
LOW⚡tests/common.py1180 def validate_can_send_from_client(self, string, msg):CODE
LOW⚡tests/common.py1188 def validate_can_send_from_server(self, string, msg):CODE
LOW⚡tests/common.py1196 def validate_closing_client_closes_server(self, msg):CODE
LOW⚡tests/common.py1204 def validate_half_closing_client_closes_server(self, msg):CODE
LOWtests/common.py515def assert_connection_rejected(client, server, name, timeout_ok=True, timeout=2):CODE
LOWtests/common.py1217 def validate_closing_server_closes_client(self, msg):CODE
LOWtests/common.py1225 def validate_half_closing_server_closes_client(self, msg):CODE
LOWtests/test-server-unix-socket-listener.py130def _run_proxy_protocol_phase():CODE
Deep Nesting10 hits · 10 pts
SeverityFileLineSnippetContext
LOWtests/test-server-semaphore-churn.py71CODE
LOWtests/test-server-large-transfer.py39CODE
LOWtests/test-server-landlock-ssl-cert-file.py42CODE
LOWtests/test-client-via-http-connect-proxy.py15CODE
LOWtests/test-server-tiny-writes.py36CODE
LOWtests/test-server-full-duplex-transfer.py45CODE
LOWtests/common.py189CODE
LOWtests/test-server-shutdown-drains-under-load.py61CODE
LOWtests/test-client-socks5-proxy.py46CODE
LOWtests/test-client-socks5-proxy.py79CODE
AI Slop Vocabulary3 hits · 9 pts
SeverityFileLineSnippetContext
MEDIUMtests/test-server-large-transfer.py146 # The harness default of 1s is enough on an idle machine but a flakeCOMMENT
MEDIUMtests/test-server-shutdown-drains-under-load.py105 # Override the harness's default 1s shutdown timeout: we want ghostunnelCOMMENT
MEDIUMtests/test-server-shutdown-drains-under-load.py130 # raises ConnectionRefusedError. On macOS the harness's SO_REUSEPORTCOMMENT
Self-Referential Comments3 hits · 9 pts
SeverityFileLineSnippetContext
MEDIUMtests/common.py129# Create a per-test temporary working directory for cert file isolationCOMMENT
MEDIUMtests/test-service-foreign-start-stop.py25 # Create a dummy service that ghostunnel did not install.COMMENT
MEDIUMtests/test-service-uninstall-foreign.py26 # Create a dummy service that ghostunnel did not install.COMMENT
Unused Imports6 hits · 6 pts
SeverityFileLineSnippetContext
LOWtests/test-server-shutdown-timeout.py5CODE
LOWtests/test-client-shutdown-timeout.py5CODE
LOWtests/test-client-shutdown-http.py9CODE
LOWtests/test-server-shutdown-sigterm.py5CODE
LOWtests/test-client-shutdown-sigterm.py5CODE
LOWtests/test-service-uninstall-foreign.py13CODE