Repository Analysis

projectdiscovery/nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

1.4 Likely human-written View on GitHub
1.4
Adjusted Score
1.4
Raw Score
100%
Time Factor
2026-05-30
Last Push
28,947
Stars
Go
Language
136,384
Lines of Code
1016
Files
182
Pattern Hits
2026-05-31
Scan Date

Score History

Severity Breakdown

CRITICAL 1HIGH 0MEDIUM 2LOW 179

Pattern Findings

182 matches across 6 categories. Click a row to expand file-level details.

Over-Commented Block175 hits · 175 pts
SeverityFileLineSnippet
LOW.goreleaser.yml81 # # NOTE(dwisiswant0): chromium doesn't support 32-bit on alpine
LOWcmd/nuclei/issue-tracker-config.yaml1# global allow/deny list. this will affect both exporters
LOWcmd/nuclei/issue-tracker-config.yaml21# # project-name is the name of the repository
LOWcmd/nuclei/issue-tracker-config.yaml41# # username is the username of the GitLab user
LOWcmd/nuclei/issue-tracker-config.yaml61# duplicate-issue-page-size: 100
LOWcmd/nuclei/issue-tracker-config.yaml81# allow-list:
LOWcmd/nuclei/issue-tracker-config.yaml101# # URL is the jira application url
LOWcmd/nuclei/issue-tracker-config.yaml121# allow-list:
LOWcmd/nuclei/issue-tracker-config.yaml141# customfield_00003:
LOWcmd/nuclei/issue-tracker-config.yaml161# api-key: ""
LOWcmd/nuclei/issue-tracker-config.yaml181# connection-string: ""
LOWinternal/tests/integration/http_test.go941 if routerErr != nil {
LOW…sts/integration/testdata/workflow/code-template-2.yaml21# digest: 490a0046304402204cbb1bdf8370e49bb930b17460fb35e15f285a3b48b165736ac0e7ba2f9bc0fb022067c134790c4a2cf646b195aa44
LOW…tests/integration/testdata/protocols/code/py-file.yaml21# digest: 4a0a00473045022100bb6b75819ea62be7415adf544e208fcff3501277f6f7a152e1c3083c476126f502201db7978917bc31c755a4ce53
LOW.github/dependabot.yml41# schedule:
LOWhelm/values.yaml21 list: /config/target-list.txt
LOWhelm/values.yaml41 #include-tags: dos,fuzz # Tag based inclusion (allows overwriting nuclei-ignore list)
LOWpkg/reporting/trackers/jira/jira.go181 // Cloud value (optional) is set to true when Jira cloud is used
LOWpkg/reporting/trackers/jira/jira.go201 // ProjectID is the ID of the project (optional)
LOWpkg/types/types.go141 // HeadlessBulkSize is the of targets analyzed in parallel for each headless template
LOWpkg/types/types.go161 InteractionsPollDuration int
LOWpkg/types/types.go221 // ShowVarDump displays variable dump
LOWpkg/types/types.go461 // OutOfScope contains a list of regexes for out-scope URLS
LOWpkg/operators/operators.go21 // Matchers contains the detection mechanism for the request to identify
LOWpkg/operators/matchers/matchers.go21
LOWpkg/operators/matchers/matchers.go41 // - value: "\"cookie-matcher\""
LOWpkg/operators/matchers/matchers.go61 // - name: Match for application/json in response headers
LOWpkg/operators/matchers/matchers.go81 // - name: Match for 7zip files
LOWpkg/operators/matchers/matchers.go101 // []string{"/html/head/title[contains(text(), 'How to Find XPath')]"}
LOWpkg/operators/extractors/extractors.go21 // extractorType is the internal type of the extractor
LOWpkg/operators/extractors/extractors.go41 // value: "1"
LOWpkg/operators/extractors/extractors.go61 // value: >
LOWpkg/operators/extractors/extractors.go81 // description: |
LOWpkg/operators/extractors/extractors.go101 // examples:
LOWpkg/input/formats/formats.go21type InputFormatOptions struct {
LOWpkg/js/libs/kerberos/kerberosx.go41
LOWpkg/js/libs/kerberos/kerberosx.go61func (c *Config) SetTimeout(timeout int) *Config {
LOWpkg/js/libs/kerberos/kerberosx.go141 // Link Constructor to Client and return
LOWpkg/js/libs/kerberos/kerberosx.go161 return &Client{Krb5Config: config}, nil
LOWpkg/js/libs/kerberos/kerberosx.go301 resp.Ticket = ticket
LOWpkg/js/libs/kerberos/kerberosx.go321// c.nj.Throw("KDC address blacklisted by network policy")
LOWpkg/js/libs/kerberos/kerberosx.go341// // login to get TGT
LOWpkg/js/libs/dcerpc/wmiexec.go21// Win32_Process.Create over the WMI IWbemServices interface (impacket:
LOWpkg/js/libs/dcerpc/dcerpc.go41// LookupResult is the result of a SID->name resolution via LSARPC.
LOWpkg/js/libs/dcerpc/dcerpc.go101// SetHash enables NTLM pass-the-hash authentication.
LOWpkg/js/libs/dcerpc/dcerpc.go281// command - the command line to run; for powershell prefix with
LOWpkg/js/libs/dcerpc/dcerpc.go341// task is registered as LocalSystem, executed once, and then deleted. The
LOWpkg/js/libs/net/net.go81)
LOWpkg/js/libs/net/net.go201 }
LOWpkg/js/libs/net/net.go241// const data = conn.RecvFullString(1024);
LOWpkg/js/libs/bytes/buffer.go41// Write appends the given data to the buffer.
LOWpkg/js/libs/bytes/buffer.go61 b.buf = append(b.buf, []byte(data)...)
LOWpkg/js/libs/bytes/buffer.go81// const buffer = new bytes.Buffer();
LOWpkg/js/libs/bytes/buffer.go101// Hex returns the hex representation of the buffer.
LOWpkg/js/libs/krbforge/krbforge.go41}
LOWpkg/js/libs/krbforge/krbforge.go81// ```javascript
LOWpkg/js/libs/ldap/ldap.go21 // // here ldap.example.com is the ldap server and acme.com is the realm
LOWpkg/js/libs/ldap/ldap.go361// close the ldap connection
LOWpkg/js/libs/ldap/adenum.go121// GetADActiveUsers returns all AD users
LOWpkg/js/libs/ldap/adenum.go141// log(to_json(users));
115 more matches not shown…
Hallucination Indicators1 hit · 10 pts
SeverityFileLineSnippet
CRITICALpkg/protocols/http/request.go1115 Severity: request.options.TemplateInfo.SeverityHolder.Severity.String(),
AI Slop Vocabulary2 hits · 6 pts
SeverityFileLineSnippet
MEDIUMpkg/catalog/disk/find.go30 // this should be replaced with more appropriate and robust logic
MEDIUMpkg/catalog/disk/find.go55 // this should be replaced with more appropriate and robust logic
Hyper-Verbose Identifiers2 hits · 2 pts
SeverityFileLineSnippet
LOWpkg/js/global/js/active_directory.js34function getDomainControllerNameBySMB(host) {
LOWpkg/js/global/js/active_directory.js47function getDomainControllerNameByLDAP(host) {
Slop Phrases1 hit · 2 pts
SeverityFileLineSnippet
LOWpkg/catalog/index/metadata.go50 // For maintainers: when adding new fields, don't forget to update the
Fake / Example Data1 hit · 1 pts
SeverityFileLineSnippet
LOWpkg/fuzz/dataformat/multipart_test.go223 assert.Equal(t, "John Doe", decoded.Get("name"))