The most full featured web-to-app toolkit on Android, a complete APK workshop that runs entirely on your phone
This report summarizes scanner evidence for shiaho777/web-to-app, a Kotlin project with 6,769 GitHub stars. SynthScan examined 382,993 lines of code across 1404 source files, recording 723 pattern matches distributed across 15 syntactic categories. The legacy adjusted pattern signal is 15.7 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 35 finding(s).
Are imports declared and package/API names verified? 610 finding(s).
Are wrappers, guards, and repeated structures necessary? 81 finding(s).
Which changes need focused human review? 723 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 723 distinct pattern matches across 15 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …/com/webtoapp/core/privacy/FingerprintGeneratorTest.kt | 48 | val hints = com.webtoapp.core.kernel.UserAgentProfileDeriver.derive(fp.userAgent) | CODE |
| CRITICAL | …va/com/webtoapp/core/webview/WebViewResumeStoreTest.kt | 55 | com.google.common.truth.Truth.assertWithMessage("unexpectedly persisted $dead") | CODE |
| CRITICAL | …ebtoapp/core/agent/llm/ReasoningContentContractTest.kt | 71 | val ev = com.webtoapp.core.agent.engine.AgentEvent.ThinkingDelta( | CODE |
| CRITICAL | app/src/main/java/com/webtoapp/WebToAppApplication.kt | 166 | com.webtoapp.core.crypto.AesCryptoEngine.clearKeyCache() | CODE |
| CRITICAL | …c/main/java/com/webtoapp/ui/viewmodel/MainViewModel.kt | 205 | com.webtoapp.core.script.UserScriptStorage.deleteScriptsForApp( | CODE |
| CRITICAL | …c/main/java/com/webtoapp/ui/viewmodel/MainViewModel.kt | 209 | com.webtoapp.core.app.ProjectDirCleaner.deleteForApp(getApplication(), webApp) | CODE |
| CRITICAL | …c/main/java/com/webtoapp/ui/viewmodel/MainViewModel.kt | 246 | com.webtoapp.core.script.UserScriptStorage.isFileReference(it.code) | CODE |
| CRITICAL | …c/main/java/com/webtoapp/ui/viewmodel/MainViewModel.kt | 250 | com.webtoapp.core.script.UserScriptStorage.internalizeScripts( | CODE |
| CRITICAL | …c/main/java/com/webtoapp/ui/viewmodel/MainViewModel.kt | 516 | injectScripts = com.webtoapp.core.script.UserScriptStorage.externalizeScripts( | CODE |
| CRITICAL | …c/main/java/com/webtoapp/ui/viewmodel/MainViewModel.kt | 538 | com.webtoapp.core.script.UserScriptStorage.deleteScriptsForApp( | CODE |
| CRITICAL | …c/main/java/com/webtoapp/ui/viewmodel/MainViewModel.kt | 543 | com.webtoapp.core.app.ProjectDirCleaner.deleteForApp(getApplication(), webApp) | CODE |
| CRITICAL | …c/main/java/com/webtoapp/ui/viewmodel/MainViewModel.kt | 684 | injectScripts = com.webtoapp.core.script.UserScriptStorage.externalizeScripts( | CODE |
| CRITICAL | …c/main/java/com/webtoapp/ui/viewmodel/MainViewModel.kt | 1502 | val config = com.webtoapp.core.scraper.WebsiteScraper.ScrapeConfig( | CODE |
| CRITICAL | …/java/com/webtoapp/ui/splash/SplashLauncherActivity.kt | 59 | if (!com.webtoapp.core.appmodifier.PayloadIntegrity.verify( | CODE |
| CRITICAL | …/java/com/webtoapp/ui/splash/SplashLauncherActivity.kt | 351 | com.webtoapp.ui.components.announcement.AnnouncementDialog( | CODE |
| CRITICAL | …/java/com/webtoapp/ui/splash/SplashLauncherActivity.kt | 352 | config = com.webtoapp.ui.components.announcement.AnnouncementConfig( | CODE |
| CRITICAL | …ava/com/webtoapp/ui/codepreview/HtmlPreviewActivity.kt | 366 | view?.evaluateJavascript(com.webtoapp.core.webview.DownloadBridge.getInjectionScript(), null) | CODE |
| CRITICAL | …ava/com/webtoapp/ui/codepreview/HtmlPreviewActivity.kt | 367 | view?.evaluateJavascript(com.webtoapp.core.webview.PrintBridge.getInjectionScript(), null) | CODE |
| CRITICAL | …rc/main/java/com/webtoapp/ui/shell/ShellServerModes.kt | 58 | if (!com.webtoapp.core.wordpress.WordPressDependencyManager.isPhpReady(context)) { | CODE |
| CRITICAL | …rc/main/java/com/webtoapp/ui/shell/ShellServerModes.kt | 96 | com.webtoapp.core.wordpress.WordPressManager.autoInstallIfNeeded( | CODE |
| CRITICAL | …rc/main/java/com/webtoapp/ui/shell/ShellServerModes.kt | 106 | com.webtoapp.core.wordpress.WordPressManager.applyRuntimeConfig( | CODE |
| CRITICAL | …rc/main/java/com/webtoapp/ui/shell/ShellServerModes.kt | 212 | com.webtoapp.core.webview.LocalHttpServer.stablePortForPackageName(portOwner) | CODE |
| CRITICAL | …rc/main/java/com/webtoapp/ui/shell/ShellServerModes.kt | 268 | com.webtoapp.core.webview.LocalHttpServer.shouldEnableCrossOriginIsolation(siteDir) | CODE |
| CRITICAL | …rc/main/java/com/webtoapp/ui/shell/ShellServerModes.kt | 411 | com.webtoapp.core.webview.LocalHttpServer.stablePortForPackageName(portOwner) | CODE |
| CRITICAL⚡ | …rc/main/java/com/webtoapp/ui/shell/ShellServerModes.kt | 547 | val nodePath = com.webtoapp.core.nodejs.NodeDependencyManager.getNodeLibraryPath(context) | CODE |
| CRITICAL⚡ | …rc/main/java/com/webtoapp/ui/shell/ShellServerModes.kt | 549 | com.webtoapp.core.shell.ShellLogger.i("NodeJsShell", "nativeLibraryDir: ${context.applicationInfo.native | CODE |
| CRITICAL⚡ | …rc/main/java/com/webtoapp/ui/shell/ShellServerModes.kt | 553 | com.webtoapp.core.shell.ShellLogger.e("NodeJsShell", "libnode.so 未找到") | CODE |
| CRITICAL⚡ | …rc/main/java/com/webtoapp/ui/shell/ShellServerModes.kt | 560 | com.webtoapp.core.shell.ShellLogger.i("NodeJsShell", "libnode.so 路径: $nodePath (size=${java.io.File(node | CODE |
| CRITICAL | …rc/main/java/com/webtoapp/ui/shell/ShellServerModes.kt | 573 | com.webtoapp.core.shell.ShellLogger.i("NodeJsShell", "提取 Node.js 项目文件到 ${projectDir.absolutePath}") | CODE |
| CRITICAL⚡ | …rc/main/java/com/webtoapp/ui/shell/ShellServerModes.kt | 599 | com.webtoapp.core.shell.ShellLogger.i("NodeJsShell", "Node.js 就绪: $serverUrl") | CODE |
| CRITICAL⚡ | …rc/main/java/com/webtoapp/ui/shell/ShellServerModes.kt | 605 | com.webtoapp.core.shell.ShellLogger.e("NodeJsShell", "Node.js 服务器启动失败") | CODE |
| CRITICAL⚡ | …rc/main/java/com/webtoapp/ui/shell/ShellServerModes.kt | 609 | com.webtoapp.core.shell.ShellLogger.e("NodeJsShell", "Node.js Shell 启动失败", e) | CODE |
| CRITICAL | …rc/main/java/com/webtoapp/ui/shell/ShellServerModes.kt | 698 | if (!com.webtoapp.core.wordpress.WordPressDependencyManager.isPhpReady(context)) { | CODE |
| CRITICAL | …rc/main/java/com/webtoapp/ui/shell/ShellServerModes.kt | 821 | val pythonHome = com.webtoapp.core.python.PythonDependencyManager.getPythonDir(context) | CODE |
| CRITICAL | …rc/main/java/com/webtoapp/ui/shell/ShellServerModes.kt | 834 | val abi = com.webtoapp.core.python.PythonDependencyManager.getDeviceAbi() | CODE |
| CRITICAL | …rc/main/java/com/webtoapp/ui/shell/ShellServerModes.kt | 1026 | val elfInfo = com.webtoapp.core.golang.GoDependencyManager.parseElf(file) | CODE |
| CRITICAL | …/java/com/webtoapp/ui/shell/ShellPermissionDelegate.kt | 55 | com.webtoapp.data.model.DownloadLocationMode.valueOf( | CODE |
| CRITICAL | …/java/com/webtoapp/ui/shell/ShellPermissionDelegate.kt | 188 | com.webtoapp.data.model.ShareDeliveryMode.valueOf(wv.shareDeliveryMode) | CODE |
| CRITICAL | …/java/com/webtoapp/ui/shell/ShellPermissionDelegate.kt | 203 | val item = com.webtoapp.core.share.SharedContentInbox.findForFileChooser( | CODE |
| CRITICAL | …/java/com/webtoapp/ui/shell/ShellPermissionDelegate.kt | 265 | com.webtoapp.core.share.SharedContentInbox.claim(activity, item.id) | CODE |
| CRITICAL | app/src/main/java/com/webtoapp/ui/shell/ShellDialogs.kt | 81 | com.webtoapp.data.model.RemoteActivationOfflinePolicy.valueOf(raw) | CODE |
| CRITICAL | app/src/main/java/com/webtoapp/ui/shell/ShellDialogs.kt | 102 | com.webtoapp.data.model.AnnouncementTemplateType.valueOf(config.announcementTemplate).toUiTemplate().type | CODE |
| CRITICAL | app/src/main/java/com/webtoapp/ui/shell/ShellDialogs.kt | 118 | com.webtoapp.ui.components.announcement.AnnouncementDialog( | CODE |
| CRITICAL | app/src/main/java/com/webtoapp/ui/shell/ShellDialogs.kt | 119 | config = com.webtoapp.ui.components.announcement.AnnouncementConfig( | CODE |
| CRITICAL | …c/main/java/com/webtoapp/ui/shell/MultiWebShellMode.kt | 599 | if (!com.webtoapp.core.webview.WebViewMemoryTrimmer.shouldTeardownWebView(level)) return | CODE |
| CRITICAL⚡ | …c/main/java/com/webtoapp/ui/shell/ShellActivityInit.kt | 22 | com.webtoapp.core.shell.ShellLogger.init( | CODE |
| CRITICAL⚡ | …c/main/java/com/webtoapp/ui/shell/ShellActivityInit.kt | 28 | com.webtoapp.core.shell.ShellLogger.i("ShellActivity", "onCreate 开始") | CODE |
| CRITICAL⚡ | …c/main/java/com/webtoapp/ui/shell/ShellActivityInit.kt | 30 | com.webtoapp.core.perf.SystemPerfOptimizer.optimizeActivity(activity) | CODE |
| CRITICAL⚡ | …c/main/java/com/webtoapp/ui/shell/ShellActivityInit.kt | 58 | com.webtoapp.core.shell.ShellLogger.i( | CODE |
| CRITICAL⚡ | …c/main/java/com/webtoapp/ui/shell/ShellActivityInit.kt | 64 | com.webtoapp.core.shell.ShellLogger.e("ShellActivity", "自启动配置注册失败", e) | CODE |
| CRITICAL⚡ | …c/main/java/com/webtoapp/ui/shell/ShellActivityInit.kt | 73 | val isolationManager = com.webtoapp.core.privacy.IsolationManager.getInstance(activity) | CODE |
| CRITICAL⚡ | …c/main/java/com/webtoapp/ui/shell/ShellActivityInit.kt | 76 | com.webtoapp.core.shell.ShellLogger.i("ShellActivity", "独立环境已初始化") | CODE |
| CRITICAL⚡ | …c/main/java/com/webtoapp/ui/shell/ShellActivityInit.kt | 79 | com.webtoapp.core.shell.ShellLogger.e("ShellActivity", "独立环境初始化失败", e) | CODE |
| CRITICAL⚡ | …c/main/java/com/webtoapp/ui/shell/ShellActivityInit.kt | 88 | com.webtoapp.core.background.BackgroundRunService.start( | CODE |
| CRITICAL⚡ | …c/main/java/com/webtoapp/ui/shell/ShellActivityInit.kt | 95 | com.webtoapp.core.background.BackgroundRunService.maybeRequestBatteryExemption(activity) | CODE |
| CRITICAL⚡ | …c/main/java/com/webtoapp/ui/shell/ShellActivityInit.kt | 97 | com.webtoapp.core.shell.ShellLogger.i("ShellActivity", "后台运行服务已启动") | CODE |
| CRITICAL⚡ | …c/main/java/com/webtoapp/ui/shell/ShellActivityInit.kt | 99 | com.webtoapp.core.shell.ShellLogger.e("ShellActivity", "后台运行服务启动失败", e) | CODE |
| CRITICAL⚡ | …c/main/java/com/webtoapp/ui/shell/ShellActivityInit.kt | 110 | com.webtoapp.core.notification.NotificationPollingService.start( | CODE |
| CRITICAL⚡ | …c/main/java/com/webtoapp/ui/shell/ShellActivityInit.kt | 119 | com.webtoapp.core.shell.ShellLogger.i("ShellActivity", "轮询通知服务已启动: url=${nc.pollUrl}") | CODE |
| CRITICAL⚡ | …c/main/java/com/webtoapp/ui/shell/ShellActivityInit.kt | 122 | com.webtoapp.core.notification.NotificationWebSocketService.start( | CODE |
| 516 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …pp/core/apkbuilder/WebViewConfigBooleanCoverageTest.kt | 28 | // ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …pp/core/apkbuilder/WebViewConfigBooleanCoverageTest.kt | 30 | // ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …pp/core/apkbuilder/WebViewConfigBooleanCoverageTest.kt | 85 | // ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …pp/core/apkbuilder/WebViewConfigBooleanCoverageTest.kt | 87 | // ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …pp/core/apkbuilder/WebViewConfigBooleanCoverageTest.kt | 148 | // ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …pp/core/apkbuilder/WebViewConfigBooleanCoverageTest.kt | 150 | // ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …pp/core/apkbuilder/WebViewConfigBooleanCoverageTest.kt | 196 | // ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …pp/core/apkbuilder/WebViewConfigBooleanCoverageTest.kt | 198 | // ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …pp/core/apkbuilder/WebViewConfigBooleanCoverageTest.kt | 302 | // ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …pp/core/apkbuilder/WebViewConfigBooleanCoverageTest.kt | 304 | // ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …java/com/webtoapp/core/share/SharedContentInboxTest.kt | 52 | // ── mime filter ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …java/com/webtoapp/core/share/SharedContentInboxTest.kt | 85 | // ── chooser matching ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …java/com/webtoapp/core/share/SharedContentInboxTest.kt | 103 | // ── filename sanitiser ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …java/com/webtoapp/core/share/SharedContentInboxTest.kt | 141 | // ── end-to-end round trip ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …java/com/webtoapp/core/share/SharedContentInboxTest.kt | 266 | // ── history relaunch (issue #1029) ──────────────────────────────────────── | COMMENT |
| MEDIUM | …java/com/webtoapp/core/share/SharedContentInboxTest.kt | 266 | // ── history relaunch (issue #1029) ──────────────────────────────────────── | COMMENT |
| MEDIUM | …java/com/webtoapp/core/share/SharedContentInboxTest.kt | 323 | // ── consume (issue #1038) ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …java/com/webtoapp/core/share/SharedContentInboxTest.kt | 323 | // ── consume (issue #1038) ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …java/com/webtoapp/ui/components/IsolationConfigCard.kt | 136 | // ── 防护强度：一键预设 ───────────────────────────── | COMMENT |
| MEDIUM | …java/com/webtoapp/ui/components/IsolationConfigCard.kt | 176 | // ── 当前指纹 ───────────────────────────────────── | COMMENT |
| MEDIUM | …java/com/webtoapp/ui/components/IsolationConfigCard.kt | 239 | // ── 环境伪装：三个维度各一个紧凑选择器 ───────────── | COMMENT |
| MEDIUM | …java/com/webtoapp/ui/components/IsolationConfigCard.kt | 251 | // ── 高级：逐项防护开关（折叠） ──────────────────── | COMMENT |
| MEDIUM | …java/com/webtoapp/ui/components/IsolationConfigCard.kt | 336 | // ──────────────────────────── 伪装维度选择器 ──────────────────────────── | COMMENT |
| MEDIUM | …java/com/webtoapp/ui/components/IsolationConfigCard.kt | 717 | // ──────────────────────────── 指纹展示辅助 ──────────────────────────── | COMMENT |
| MEDIUM | …a/com/webtoapp/ui/components/NotificationConfigCard.kt | 62 | // ── 头部 ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | …a/com/webtoapp/ui/components/NotificationConfigCard.kt | 127 | // ── 推送通道 ───────────────────────────────────── | COMMENT |
| MEDIUM | …a/com/webtoapp/ui/components/NotificationConfigCard.kt | 196 | // ──────────────────────────── 轮询 ──────────────────────────── | COMMENT |
| MEDIUM | …a/com/webtoapp/ui/components/NotificationConfigCard.kt | 326 | // ──────────────────────────── WebSocket ──────────────────────────── | COMMENT |
| MEDIUM | …a/com/webtoapp/ui/components/NotificationConfigCard.kt | 400 | // ──────────────────────────── FCM ──────────────────────────── | COMMENT |
| MEDIUM | …a/com/webtoapp/ui/components/NotificationConfigCard.kt | 513 | // ──────────────────────────── 共享小部件 ──────────────────────────── | COMMENT |
| MEDIUM | …/com/webtoapp/ui/components/BackgroundRunConfigCard.kt | 46 | // ── 头部：图标 + 标题 + 状态副标题 + 开关 ────────────────── | COMMENT |
| MEDIUM | …/com/webtoapp/ui/components/BackgroundRunConfigCard.kt | 111 | // ── 保持唤醒 ───────────────────────────────────── | COMMENT |
| MEDIUM | …/com/webtoapp/ui/components/BackgroundRunConfigCard.kt | 151 | // ── 常驻通知（前台服务必需，可自定义文案）─────────── | COMMENT |
| MEDIUM | …webtoapp/core/appearance/BrowserDisguiseJsGenerator.kt | 46 | // ══════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | …webtoapp/core/appearance/BrowserDisguiseJsGenerator.kt | 49 | // ══════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | …webtoapp/core/appearance/BrowserDisguiseJsGenerator.kt | 67 | // ══════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | …webtoapp/core/appearance/BrowserDisguiseJsGenerator.kt | 69 | // ══════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | …webtoapp/core/appearance/BrowserDisguiseJsGenerator.kt | 679 | // ══════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | …webtoapp/core/appearance/BrowserDisguiseJsGenerator.kt | 681 | // ══════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | …webtoapp/core/appearance/BrowserDisguiseJsGenerator.kt | 769 | // ══════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | …webtoapp/core/appearance/BrowserDisguiseJsGenerator.kt | 771 | // ══════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | …webtoapp/core/appearance/BrowserDisguiseJsGenerator.kt | 800 | // ══════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | …webtoapp/core/appearance/BrowserDisguiseJsGenerator.kt | 802 | // ══════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | app/src/main/java/com/webtoapp/core/i18n/Strings.kt | 5162 | // ── Inbound share sheet (issue #943) ──────────────────────────────────────── | COMMENT |
| MEDIUM | app/src/main/java/com/webtoapp/core/i18n/Strings.kt | 5162 | // ── Inbound share sheet (issue #943) ──────────────────────────────────────── | COMMENT |
| MEDIUM | …ain/java/com/webtoapp/core/share/SharedContentInbox.kt | 245 | // ────────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ain/java/com/webtoapp/core/share/SharedContentInbox.kt | 247 | // ────────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .github/scripts/ci/validate_modules.py | 34 | # ───────────────────────── enum values (must mirror the Kotlin source) ─ | COMMENT |
| MEDIUM | .github/scripts/ci/validate_modules.py | 66 | # ───────────────────────── regex helpers ─────────────────────────────── | COMMENT |
| MEDIUM | .github/scripts/ci/validate_modules.py | 123 | # ───────────────────────── primitive checks ──────────────────────────── | COMMENT |
| MEDIUM | .github/scripts/ci/validate_modules.py | 182 | # ───────────────────────── registry checks ───────────────────────────── | COMMENT |
| MEDIUM | .github/scripts/ci/validate_modules.py | 274 | # ───────────────────────── cross-file consistency ───────────────────── | COMMENT |
| MEDIUM | .github/scripts/ci/validate_modules.py | 306 | # ───────────────────────── per-folder structural checks ─────────────── | COMMENT |
| MEDIUM | .github/scripts/ci/validate_modules.py | 538 | # ───────────────────────── entry point ───────────────────────────────── | COMMENT |
| MEDIUM | .github/scripts/ci/generate_submissions.py | 66 | # ───────────────────────── git helpers ───────────────────────────────── | COMMENT |
| MEDIUM | .github/scripts/ci/generate_submissions.py | 134 | # ───────────────────────── GitHub API helpers ────────────────────────── | COMMENT |
| MEDIUM | .github/scripts/ci/generate_submissions.py | 214 | # ───────────────────────── core logic ────────────────────────────────── | COMMENT |
| MEDIUM | .github/scripts/ci/generate_submissions.py | 525 | # ───────────────────────── CLI entry ─────────────────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …src/main/assets/sample_projects/python-flask-en/app.py | 173 | except: pass | CODE |
| HIGH | app/src/main/assets/sample_projects/python-flask/app.py | 506 | except Exception: | CODE |
| HIGH | …src/main/assets/sample_projects/python-flask-ar/app.py | 158 | except: pass | CODE |
| HIGH | .github/scripts/ci/validate_modules.py | 498 | except (json.JSONDecodeError, OSError): | CODE |
| HIGH | .github/scripts/ci/generate_submissions.py | 298 | except (json.JSONDecodeError, OSError): | CODE |
| HIGH | .github/scripts/ci/generate_submissions.py | 330 | except subprocess.CalledProcessError: | CODE |
| HIGH | .github/scripts/ci/generate_submissions.py | 424 | except (urllib.error.HTTPError, urllib.error.URLError): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …src/main/assets/sample_projects/python-flask-en/app.py | 8 | CODE | |
| LOW | …src/main/assets/sample_projects/python-flask-en/app.py | 10 | CODE | |
| LOW | …src/main/assets/sample_projects/python-flask-en/app.py | 11 | CODE | |
| LOW | …src/main/assets/sample_projects/python-flask-en/app.py | 12 | CODE | |
| LOW | …/main/assets/sample_projects/python-fastapi-en/main.py | 6 | CODE | |
| LOW | …/main/assets/sample_projects/python-fastapi-en/main.py | 7 | CODE | |
| LOW | …/main/assets/sample_projects/python-fastapi-en/main.py | 13 | CODE | |
| LOW | …src/main/assets/sample_projects/python-fastapi/main.py | 6 | CODE | |
| LOW | …src/main/assets/sample_projects/python-fastapi/main.py | 7 | CODE | |
| LOW | …src/main/assets/sample_projects/python-fastapi/main.py | 13 | CODE | |
| LOW | app/src/main/assets/sample_projects/python-flask/app.py | 8 | CODE | |
| LOW | app/src/main/assets/sample_projects/python-flask/app.py | 10 | CODE | |
| LOW | app/src/main/assets/sample_projects/python-flask/app.py | 11 | CODE | |
| LOW | app/src/main/assets/sample_projects/python-flask/app.py | 12 | CODE | |
| LOW | …n/assets/sample_projects/python-django/mysite/views.py | 5 | CODE | |
| LOW | …/main/assets/sample_projects/python-fastapi-ar/main.py | 6 | CODE | |
| LOW | …/main/assets/sample_projects/python-fastapi-ar/main.py | 7 | CODE | |
| LOW | …/main/assets/sample_projects/python-fastapi-ar/main.py | 13 | CODE | |
| LOW | …src/main/assets/sample_projects/python-flask-ar/app.py | 7 | CODE | |
| LOW | …ssets/sample_projects/python-django-en/mysite/views.py | 5 | CODE | |
| LOW | …ssets/sample_projects/python-django-ar/mysite/views.py | 4 | CODE | |
| LOW | …ssets/sample_projects/python-django-ar/mysite/views.py | 6 | CODE | |
| LOW | .github/scripts/audit_ui_design_system.py | 10 | CODE | |
| LOW | .github/scripts/ci/validate_modules.py | 23 | CODE | |
| LOW | .github/scripts/ci/validate_modules.py | 26 | CODE | |
| LOW | .github/scripts/ci/validate_modules.py | 31 | CODE | |
| LOW | .github/scripts/ci/generate_submissions.py | 43 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …p/src/main/java/com/webtoapp/ui/shared/WindowHelper.kt | 141 | // out edge-to-edge, the system neither resizes it for the keyboard nor reports IME | COMMENT |
| LOW | …com/webtoapp/core/extension/ChromeExtensionPolyfill.kt | 1521 | COMMENT | |
| LOW | …webtoapp/core/appearance/BrowserDisguiseJsGenerator.kt | 801 | // [FINAL] 最终封印 — 属性枚举顺序 & 冻结关键对象 | COMMENT |
| LOW | …ain/java/com/webtoapp/core/apkbuilder/ApkBuildCache.kt | 401 | parts += "openWith=${config.openWithEnabled}" | COMMENT |
| LOW | …ain/java/com/webtoapp/core/apkbuilder/AxmlRebuilder.kt | 1321 | // APK. Fragment root is <fragment>: its <application> child's elements are | COMMENT |
| LOW | app/src/main/cpp/sys_optimizer.c | 1 | #define _GNU_SOURCE | COMMENT |
| LOW | app/src/main/cpp/perf_engine.c | 1 | #include <jni.h> | COMMENT |
| LOW | app/src/main/cpp/static_exec_loader.c | 21 | * | COMMENT |
| LOW | app/src/main/cpp/static_exec_loader.c | 41 | COMMENT | |
| LOW | app/src/main/cpp/static_exec_loader.c | 421 | COMMENT | |
| LOW | app/src/main/cpp/node_bridge.cpp | 1 | #include <jni.h> | COMMENT |
| LOW | app/src/main/cpp/go_exec_loader.c | 1 | #include <errno.h> | COMMENT |
| LOW | app/src/main/cpp/go_exec_loader.c | 21 | #define ET_EXEC 2 | COMMENT |
| LOW | app/src/main/cpp/go_exec_loader.c | 41 | #endif | COMMENT |
| LOW | …ets/web_extensions/wta_native_bridge/content_script.js | 1 | // WTA Native Bridge content script (GeckoView). | COMMENT |
| LOW | docs/extensions/userscript.md | 1 | # Userscripts | COMMENT |
| LOW | docs/zh/extensions/userscript.md | 1 | # 油猴脚本 | COMMENT |
| LOW | .github/workflows/modules-publish.yml | 1 | name: Module Market Publish | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …/main/assets/sample_projects/python-fastapi-en/main.py | 134 | document.getElementById('result').textContent=JSON.stringify(d,null,2)+'\\n\\n⏱️ '+ms+'ms'; | CODE |
| HIGH | …src/main/assets/sample_projects/python-fastapi/main.py | 134 | document.getElementById('result').textContent=JSON.stringify(d,null,2)+'\\n\\n⏱️ '+ms+'ms'; | CODE |
| HIGH | …/main/assets/sample_projects/python-fastapi-ar/main.py | 134 | document.getElementById('result').textContent=JSON.stringify(d,null,2)+'\\n\\n⏱️ '+ms+'ms'; | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …/main/assets/sample_projects/python-fastapi-en/main.py | 0 | fastapi api monitor — 精美的 api 监控仪表盘 展示 fastapi 的高性能异步能力，包含交互式 api 文档 | STRING |
| HIGH | …src/main/assets/sample_projects/python-fastapi/main.py | 0 | fastapi api monitor — 精美的 api 监控仪表盘 展示 fastapi 的高性能异步能力，包含交互式 api 文档 | STRING |
| HIGH | …/main/assets/sample_projects/python-fastapi-ar/main.py | 0 | fastapi api monitor — 精美的 api 监控仪表盘 展示 fastapi 的高性能异步能力，包含交互式 api 文档 | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …rc/main/java/com/webtoapp/core/python/PythonRuntime.kt | 697 | except Exception: | CODE |
| LOW | …rc/main/java/com/webtoapp/core/python/PythonRuntime.kt | 716 | except Exception: | CODE |
| LOW | …rc/main/java/com/webtoapp/core/python/PythonRuntime.kt | 740 | except Exception: | CODE |
| LOW | …rc/main/java/com/webtoapp/core/python/PythonRuntime.kt | 750 | except Exception: | CODE |
| MEDIUM | …rc/main/java/com/webtoapp/core/python/PythonRuntime.kt | 762 | print(f"Error: Entry file not found: {entry_file}", file=sys.stderr) | CODE |
| MEDIUM | …rc/main/java/com/webtoapp/core/python/PythonRuntime.kt | 682 | def _patched_version(name): | CODE |
| MEDIUM | …c/main/java/com/webtoapp/core/apkbuilder/ApkBuilder.kt | 2914 | def _patched_version(name): | CODE |
| LOW | …c/main/java/com/webtoapp/core/apkbuilder/ApkBuilder.kt | 2927 | except Exception: | CODE |
| LOW | …c/main/java/com/webtoapp/core/apkbuilder/ApkBuilder.kt | 2946 | except Exception: | CODE |
| LOW | app/src/main/assets/sample_projects/python-flask/app.py | 506 | except Exception: | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/generate_shell_strings.py | 41 | CODE | |
| LOW | scripts/generate_shell_strings.py | 155 | CODE | |
| LOW | scripts/generate_shell_strings.py | 184 | CODE | |
| LOW | scripts/generate_shell_strings.py | 214 | CODE | |
| LOW | scripts/generate_shell_strings.py | 261 | CODE | |
| LOW | scripts/generate_shell_strings.py | 282 | CODE | |
| LOW | scripts/generate_shell_strings.py | 348 | CODE | |
| LOW | scripts/generate_shell_strings.py | 394 | CODE | |
| LOW | .github/scripts/ci/validate_modules.py | 502 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …c/main/java/com/webtoapp/ui/shell/MultiWebShellMode.kt | 464 | // The parent scaffold already reserves a solid status bar. A transparent | COMMENT |
| MEDIUM | …c/main/java/com/webtoapp/ui/shell/MultiWebShellMode.kt | 568 | // Fullscreen content padding is already applied by the parent scaffold | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …/webtoapp/core/apkbuilder/AppTypePreflightSmokeTest.kt | 126 | adminEmail = "admin@example.com", | CODE |
| LOW | …in/java/com/webtoapp/core/extension/ExtensionModule.kt | 178 | @SerializedName("placeholder") | CODE |
| LOW | …btoapp/core/agent/export/SaveSessionAsModuleUseCase.kt | 149 | placeholder = c.optString("placeholder") | CODE |
| LOW | …/com/webtoapp/core/agent/tool/builtin/PreviewScript.kt | 47 | var name = (el.getAttribute('aria-label') || el.getAttribute('placeholder') || el.innerText || el.value || ' | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/check_config_field_drift.py | 69 | def extract_object_returned_keys(text: str) -> set[str]: | CODE |
| LOW | .github/scripts/ci/validate_modules.py | 276 | def _validate_plugin_registry_consistency( | CODE |
| LOW | .github/scripts/ci/generate_submissions.py | 278 | def _read_existing_submissions() -> dict[str, Any]: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/workflows/modules-publish.yml | 5 | # This file is what tells the in-app market who submitted each module | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | app/src/main/java/com/webtoapp/core/i18n/StringsA.kt | 12731 | AppLanguage.ENGLISH -> "Icons generated by AI will be saved here automatically" | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …c/main/java/com/webtoapp/core/apkbuilder/ApkBuilder.kt | 2274 | // Re-parse and re-encode to canonical DER so the stored format is robust to the | COMMENT |