Home / stalwartlabs / stalwart
Repository Analysis

stalwartlabs/stalwart

All-in-one Mail & Collaboration server. Secure, scalable and fluent in every protocol (IMAP, JMAP, SMTP, CalDAV, CardDAV, WebDAV).

2.4 Likely human-written View on GitHub
2.4
Adjusted Score
2.4
Raw Score
100%
Time Factor
2026-05-29
Last Push
12,995
Stars
Rust
Language
364,400
Lines of Code
1333
Files
237
Pattern Hits
2026-05-31
Scan Date

Score History

Severity Breakdown

CRITICAL 56HIGH 0MEDIUM 44LOW 137

Pattern Findings

237 matches across 12 categories. Click a row to expand file-level details.

Hallucination Indicators56 hits · 605 pts
SeverityFileLineSnippet
CRITICALcrates/imap/src/op/list.rs188 mailbox_name: self.server.core.email.shared_folder.as_str().into(),
CRITICALcrates/imap/src/op/create.rs181 if path.first() == Some(&self.server.core.email.shared_folder.as_str()) {
CRITICALcrates/imap/src/op/namespace.rs33 Some(self.server.core.email.shared_folder.as_str().into())
CRITICALcrates/spam-filter/src/analysis/rules.rs28 if !self.core.spam.rules.url.is_empty() {
CRITICALcrates/spam-filter/src/analysis/rules.rs45 if !self.core.spam.rules.domain.is_empty() {
CRITICALcrates/spam-filter/src/analysis/rules.rs64 if !self.core.spam.rules.email.is_empty() {
CRITICALcrates/spam-filter/src/analysis/rules.rs102 if !self.core.spam.rules.ip.is_empty() {
CRITICALcrates/spam-filter/src/analysis/rules.rs121 if !self.core.spam.rules.header.is_empty() {
CRITICALcrates/spam-filter/src/analysis/rules.rs150 if !self.core.spam.rules.body.is_empty() {
CRITICALcrates/spam-filter/src/analysis/rules.rs182 if !self.core.spam.rules.any.is_empty() {
CRITICALcrates/spam-filter/src/analysis/domain.rs238 email.element.email.domain_part.fqdn.clone(),
CRITICALcrates/spam-filter/src/analysis/mime.rs389 Some((name, self.core.spam.lists.file_extensions.get(ext)?))
CRITICALcrates/spam-filter/src/analysis/mime.rs393 .and_then(|(_, ext)| self.core.spam.lists.file_extensions.get(ext));
CRITICALcrates/spam-filter/src/analysis/score.rs64 let score = match self.core.spam.lists.scores.get(tag) {
CRITICALcrates/spam-filter/src/modules/expression.rs45 ExpressionVariable::HeloDomain => self.ctx.output.ehlo_host.fqdn.as_str().into(),
CRITICALcrates/spam-filter/src/modules/expression.rs52 ExpressionVariable::EnvFrom => self.ctx.output.env_from_addr.address.as_str().into(),
CRITICALcrates/spam-filter/src/modules/expression.rs54 self.ctx.output.env_from_addr.local_part.as_str().into()
CRITICALcrates/spam-filter/src/modules/expression.rs72 ExpressionVariable::From => self.ctx.output.from.email.address.as_str().into(),
CRITICALcrates/spam-filter/src/modules/expression.rs81 ExpressionVariable::FromLocal => self.ctx.output.from.email.local_part.as_str().into(),
CRITICALcrates/spam-filter/src/modules/expression.rs83 self.ctx.output.from.email.domain_part.fqdn.as_str().into()
CRITICALcrates/common/src/auth/access_token.rs51 self.core.network.security.default_role_ids_user.as_slice()
CRITICALcrates/common/src/auth/access_token.rs55 self.core.network.security.default_role_ids_admin.as_slice()
CRITICALcrates/common/src/auth/access_token.rs221 self.core.network.security.default_role_ids_group.as_slice(),
CRITICALcrates/common/src/auth/permissions.rs116 UserRoles::User => self.core.network.security.default_role_ids_user.as_slice(),
CRITICALcrates/common/src/auth/permissions.rs119 self.core.network.security.default_role_ids_admin.as_slice()
CRITICALcrates/common/src/auth/permissions.rs137 .unwrap_or(self.core.network.security.default_role_ids_group.as_slice()),
CRITICALcrates/common/src/network/security.rs344 self.core.network.security.auth_fail_rate.is_some()
CRITICALcrates/common/src/network/dns/records.rs391 .map(|doc| self.core.network.info.pacc.build(&doc.url))
CRITICALcrates/common/src/network/dns/update.rs1244 match self.core.smtp.resolvers.dns.txt_raw_lookup(&name).await {
CRITICALcrates/common/src/expr/eval.rs224 stack.push(self.core.core.network.server_name.as_str().into())
CRITICALcrates/common/src/expr/eval.rs227 stack.push(self.core.core.email.default_domain_name.as_str().into())
CRITICALcrates/common/src/expr/eval.rs229 SystemVariable::NodeId => stack.push(self.core.core.network.node_id.into()),
CRITICALcrates/common/src/scripts/plugins/lookup.rs31 _ => Some(ctx.server.core.storage.memory.clone()),
CRITICALcrates/common/src/scripts/plugins/lookup.rs57 _ => Some(ctx.server.core.storage.memory.clone()),
CRITICALcrates/common/src/scripts/plugins/lookup.rs78 _ => Some(ctx.server.core.storage.memory.clone()),
CRITICALcrates/common/src/scripts/plugins/query.rs24 _ => Some(ctx.server.core.storage.data.clone()),
CRITICALcrates/http/src/request.rs200 self.core.network.http.url_https.to_string(),
CRITICALcrates/http/src/request.rs776 if !server.core.network.http.response_headers.is_empty() {
CRITICALcrates/http/src/auth/oauth/token.rs67 let issuer = self.core.network.http.url_https.to_string();
CRITICALcrates/smtp/src/reporting/tls.rs346 .and_then(|idx| report.report.policies.0.inner.get_mut(idx))
CRITICALcrates/smtp/src/reporting/tls.rs419 &mut report.report.policies.0.inner.last_mut().unwrap().value
CRITICALcrates/smtp/src/inbound/data.rs378 let message_id = self.server.inner.data.queue_id_gen.generate();
CRITICALcrates/smtp/src/queue/quota.rs37 if !self.core.smtp.queue.quota.sender.is_empty() {
CRITICALcrates/smtp/src/queue/quota.rs62 if !self.core.smtp.queue.quota.rcpt_domain.is_empty() {
CRITICALcrates/jmap/src/registry/mapping/action.rs212 set.server.inner.data.applications.reload(&mut bp).await;
CRITICALcrates/jmap/src/registry/mapping/action.rs401 let (score, disposition) = match server.core.spam.lists.scores.get(&tag) {
CRITICALcrates/jmap/src/registry/mapping/log.rs35 let Some(path) = get.server.core.metrics.log_path.clone() else {
CRITICALcrates/jmap/src/registry/mapping/log.rs75 let Some(path) = req.server.core.metrics.log_path.clone() else {
CRITICALcrates/services/src/task_manager/manager.rs530 server.core.network.task_manager.total_deadline.as_secs(),
CRITICALtests/src/imap/antispam.rs86 assert!(test.server.inner.data.spam_classifier.load().is_active());
CRITICALtests/src/smtp/session.rs279 self.server.inner.data.queue_id_gen.generate(),
CRITICALtests/src/smtp/inbound/asn.rs90 if test.server.inner.data.asn_geo_data.lock.available_permits() > 0 {
CRITICALtests/src/webdav/prop.rs640 (0..=(test.server.core.groupware.dead_property_size.unwrap() + 1))
CRITICALtests/src/webdav/lock.rs165 (0..=test.server.core.groupware.dead_property_size.unwrap() + 1)
CRITICALtests/src/store/blob.rs34 let store = test.server.core.storage.data.clone();
CRITICALtests/src/store/blob.rs35 let blob_store = test.server.core.storage.blob.clone();
Fake / Example Data95 hits · 95 pts
SeverityFileLineSnippet
LOWcrates/jmap-proto/src/request/parser.rs814 "email": "foo@bar.com"
LOWcrates/jmap-proto/src/request/parser.rs828 "email": "foo@bar.com"
LOWcrates/jmap-proto/src/request/parser.rs860 "email": "foo@bar.com"
LOWcrates/directory/src/core/sasl.rs175 Some("user@example.com".to_string())
LOWcrates/imap-proto/src/protocol/fetch.rs998 name: Some("John Doe".into()),
LOWtests/resources/itip/google_calendar.txt57summary.attendee: Participants([ItipParticipant { email: "a@gmail.com", name: Some("John Doe"), is_organizer: true }, It
LOWtests/resources/itip/google_calendar.txt78 CN="John Doe";X-NUM-GUESTS=0:mailto:a@gmail.com
LOWtests/resources/itip/google_calendar.txt79ORGANIZER;CN="John Doe":mailto:a@gmail.com
LOWtests/resources/itip/google_calendar.txt171summary.attendee: Participants([ItipParticipant { email: "a@gmail.com", name: Some("John Doe"), is_organizer: true }, It
LOWtests/resources/itip/google_calendar.txt193 CN="John Doe";X-NUM-GUESTS=0:mailto:a@gmail.com
LOWtests/resources/itip/google_calendar.txt194ORGANIZER;CN="John Doe":mailto:a@gmail.com
LOWtests/resources/itip/google_calendar.txt241 CN="John Doe";X-NUM-GUESTS=0:mailto:a@gmail.com
LOWtests/resources/itip/google_calendar.txt242ORGANIZER;CN="John Doe":mailto:a@gmail.com
LOWtests/resources/ldap/ldap.cfg58 principalName = ["John Doe"]
LOWtests/resources/ldap/ldap.cfg69 principalName = ["Jane Doe"]
LOWtests/resources/jmap/email_parse/headers.json647 "name": "John Doe",
LOWtests/resources/jmap/email_parse/headers.json660 "name": "John Doe",
LOWtests/resources/jmap/email_parse/headers.json670 "name": "John Doe",
LOWtests/resources/jmap/email_parse/headers.json693 "name": "John Doe",
LOWtests/resources/jmap/email_parse/headers.json764 "name": "John Doe",
LOWtests/resources/jmap/email_parse/headers.json804 "name": "John Doe",
LOWtests/resources/jmap/email_get/headers.json681 "name": "John Doe",
LOWtests/resources/jmap/email_get/headers.json694 "name": "John Doe",
LOWtests/resources/jmap/email_get/headers.json704 "name": "John Doe",
LOWtests/resources/jmap/email_get/headers.json727 "name": "John Doe",
LOWtests/resources/jmap/email_get/headers.json798 "name": "John Doe",
LOWtests/resources/jmap/email_get/headers.json838 "name": "John Doe",
LOWtests/src/cluster/broadcast.rs177 Property::Description: "John Doe"
LOWtests/src/cluster/broadcast.rs189 Some("John Doe")
LOWtests/src/cluster/broadcast.rs198 Some("John Doe")
LOWtests/src/cluster/stress.rs41 let admin = test.create_admin_account("admin@example.com").await;
LOWtests/src/cluster/stress.rs56 let client = Arc::new(test.account("admin@example.com").jmap_client().await);
LOWtests/src/cluster/stress.rs285 let client = Arc::new(test.account("admin@example.com").jmap_client().await);
LOWtests/src/imap/mod.rs54 let admin = test.create_admin_account("admin@example.com").await;
LOWtests/src/imap/mod.rs61 "John Doe",
LOWtests/src/imap/antispam.rs27 let admin = test.account("admin@example.com");
LOWtests/src/imap/basic.rs19 username: Some("user@example.com".to_string()),
LOWtests/src/directory/synchronization.rs33 description: "John Doe".to_string().into(),
LOWtests/src/directory/synchronization.rs51 description: "John Doe".to_string().into(),
LOWtests/src/directory/synchronization.rs74 assert_eq!(account_out.description.as_deref(), Some("John Doe"));
LOWtests/src/directory/ldap.rs32 description: Some("John Doe".into()),
LOWtests/src/directory/ldap.rs79 description: Some("John Doe".into()),
LOWtests/src/directory/ldap.rs100 description: Some("John Doe".into())
LOWtests/src/directory/oidc.rs47 description: Some("John Doe".to_string())
LOWtests/src/directory/oidc.rs69 description: Some("John Doe".to_string())
LOWtests/src/directory/sql.rs31 "VALUES ('john@example.org', 'john secret', 'John Doe', 'individual')"
LOWtests/src/directory/sql.rs35 "VALUES ('jane@example.org', 'jane secret', 'Jane Doe', 'individual')"
LOWtests/src/directory/sql.rs101 description: Some("John Doe".to_string()),
LOWtests/src/directory/sql.rs122 description: Some("John Doe".to_string()),
LOWtests/src/directory/sql.rs132 description: Some("Jane Doe".to_string()),
LOWtests/src/directory/integration.rs45 Some("John Doe")
LOWtests/src/directory/integration.rs86 "John Doe",
LOWtests/src/smtp/lookup/expressions.rs52 ("john@foobar.org", "12345 + extra safety", "John Doe", &[]),
LOWtests/src/smtp/inbound/auth.rs33 "John Doe",
LOWtests/src/smtp/inbound/vrfy.rs29 ("john@foobar.org", "12345 + extra safety", "John Doe", &[]),
LOWtests/src/smtp/inbound/rcpt.rs37 ("john@foobar.org", "12345 + extra safety", "John Doe", &[]),
LOWtests/src/smtp/inbound/data.rs39 ("john@foobar.org", "12345 + extra safety", "John Doe", &[]),
LOWtests/src/webdav/cal_scheduling.rs638 name: Some("John Doe".to_string()),
LOWtests/src/webdav/cal_scheduling.rs766 name: Some("John Doe".to_string()),
LOWtests/src/webdav/copy_move.rs18 let admin = test.account("admin@example.com");
35 more matches not shown…
Decorative Section Separators30 hits · 93 pts
SeverityFileLineSnippet
MEDIUMtests/docker/docker-compose.yml9 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml11 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml19 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml21 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml80 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml82 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml89 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml91 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml257 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml259 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml267# =============================================================================
MEDIUMtests/docker/docker-compose.yml269# =============================================================================
MEDIUMtests/docker/docker-compose.yml33 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml35 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml49 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml51 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml104 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml106 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml118 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml120 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml141 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml143 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml164 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml166 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml194 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml199 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml211 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml213 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml230 # ---------------------------------------------------------------------------
MEDIUMtests/docker/docker-compose.yml232 # ---------------------------------------------------------------------------
Excessive Try-Catch Wrapping19 hits · 33 pts
SeverityFileLineSnippet
LOWresources/scripts/ossify.py70 except Exception as e:
MEDIUMresources/scripts/ossify.py71 print(f"Error reading file {file_path}: {e}")
LOWresources/scripts/ossify.py144 except Exception as e:
MEDIUMresources/scripts/ossify.py182 print(f"Error: {args.directory} is not a valid directory")
LOWresources/scripts/migrate_v016.py1804 except Exception as exc:
MEDIUMresources/scripts/imap-log-sanitizer.py132 print(f"Error: File '{args.input_file}' not found")
LOWresources/scripts/imap-log-sanitizer.py134 except Exception as e:
MEDIUMresources/scripts/imap-log-sanitizer.py135 print(f"Error reading file: {e}")
LOWresources/scripts/imap-log-sanitizer.py159 except Exception as e:
MEDIUMresources/scripts/imap-log-sanitizer.py160 print(f"Error writing output: {e}")
MEDIUMtests/resources/scripts/imap_import_single.py24 print(f'Error while appending message: {response_code} {response_details}')
LOWtests/resources/scripts/stress_test.py54 except Exception as e:
LOWtests/resources/scripts/stress_test.py65 except Exception as e:
LOWtests/resources/scripts/stress_test.py81 except Exception as e:
LOWtests/resources/scripts/stress_test.py98 except Exception as e:
MEDIUMtests/resources/scripts/stress_test.py46def smtp_send_message(username, password, recipient):
MEDIUMtests/resources/scripts/stress_test.py57def imap_append_message(username, password, recipient):
MEDIUMtests/resources/scripts/stress_test.py68def imap_list_fetch(username, password):
MEDIUMtests/resources/scripts/stress_test.py84def imap_delete_message(username, password):
Over-Commented Block16 hits · 16 pts
SeverityFileLineSnippet
LOWinstall.sh201
LOWinstall.sh301}
LOWcrates/types/src/keyword.rs61 #[serde(rename(serialize = "$draft"))]
LOWcrates/jmap-proto/src/request/capability.rs21 #[serde(rename(serialize = "capabilities"))]
LOWcrates/common/src/network/autoconfig/pacc.rs61}
LOWcrates/common/src/telemetry/tracers/journald.rs121 /// - severe Kernel BUG
LOWcrates/common/src/telemetry/tracers/journald.rs141 ///
LOWcrates/common/src/telemetry/tracers/journald.rs161 Notice = b'5',
LOWcrates/common/src/telemetry/tracers/journald.rs201 "journald does not exist in this environment",
LOWcrates/registry/src/schema/structs.rs2321#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
LOWcrates/registry/src/schema/structs.rs3281#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
LOWcrates/store/src/lib.rs161 // SPDX-License-Identifier: LicenseRef-SEL
LOWcrates/store/src/dispatch/blob.rs201 // SPDX-SnippetBegin
LOWcrates/store/src/backend/sqlite/pool.rs61 pub fn with_flags(self, flags: OpenFlags) -> Self {
LOWresources/scripts/minify_html.sh1#!/usr/bin/env bash
LOW.github/workflows/scorecard.yml41 - name: "Run analysis"
Self-Referential Comments3 hits · 9 pts
SeverityFileLineSnippet
MEDIUMtests/docker/powerdns/init-zone.sh13# Create the zone with default SOA + NS
MEDIUMtests/docker/scripts/init-minio.sh10# Create the stalwart bucket
MEDIUMtests/resources/scripts/stress_test.py23 # Create an SSL context
Deep Nesting6 hits · 6 pts
SeverityFileLineSnippet
LOWresources/scripts/ossify.py23
LOWresources/scripts/ossify.py75
LOWresources/scripts/ossify.py114
LOWresources/scripts/ossify.py160
LOWresources/scripts/migrate_v016.py834
LOWresources/scripts/imap-log-sanitizer.py102
Unused Imports5 hits · 5 pts
SeverityFileLineSnippet
LOWresources/scripts/ossify.py18
LOWresources/scripts/ossify.py20
LOWresources/scripts/migrate_v016.py29
LOWresources/scripts/imap-log-sanitizer.py13
LOWtests/resources/scripts/imap_import_single.py6
Hyper-Verbose Identifiers4 hits · 4 pts
SeverityFileLineSnippet
LOWresources/scripts/ossify.py75def remove_proprietary_snippets(content: str) -> Tuple[str, int]:
LOWresources/scripts/migrate_v016.py947 def _tenant_default_domain_cid(self, p: dict[str, Any]) -> str | None:
LOWresources/scripts/migrate_v016.py1281 def _is_same_kv_store_as_data(self, sub: dict[str, str]) -> bool:
LOWtests/resources/scripts/stress_test.py22def allow_invalid_certificates():
AI Slop Vocabulary1 hit · 3 pts
SeverityFileLineSnippet
MEDIUMcrates/smtp/Cargo.toml65#harness = false
Redundant / Tautological Comments1 hit · 2 pts
SeverityFileLineSnippet
LOWinstall.sh838# Check if curl supports the --retry flag, then pass it to the curl invocation.
Example Usage Blocks1 hit · 2 pts
SeverityFileLineSnippet
LOWresources/scripts/minify_html.sh9# Usage: