Malicious traffic detection system
This report presents the forensic synthetic code analysis of stamparm/maltrail, a Python project with 8,588 GitHub stars. SynthScan v2.0 examined 103,861 lines of code across 249 source files, recording 870 pattern matches distributed across 12 syntactic categories. The overall adjusted score of 12.2 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 870 distinct pattern matches across 12 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | core/quic_sni.py | 219 | def derive_client_initial_keys(dcid, version=1): | CODE |
| LOW | core/quic_sni.py | 250 | def extract_sni_from_quic_initial(udp_payload): | CODE |
| LOW | core/common.py | 768 | def _format_action_invocation(self, action): | STRING |
| LOW | core/doctor.py | 131 | def check_update_reachability(): | CODE |
| LOW | tests/test_reference.py | 60 | def test_no_substring_false_positive(self): | CODE |
| LOW⚡ | tests/test_reference.py | 110 | def test_a_trail_with_no_citation_is_not_reported_as_missing_provenance(self): | CODE |
| LOW⚡ | tests/test_reference.py | 115 | def test_no_sidecar_names_what_restores_it(self): | CODE |
| LOW⚡ | tests/test_reference.py | 123 | def test_a_corrupt_sidecar_does_not_take_the_endpoint_down(self): | CODE |
| LOW⚡ | tests/test_reference.py | 132 | def test_it_reopens_when_the_sidecar_changes(self): | CODE |
| LOW⚡ | tests/test_ignore.py | 25 | def test_no_config_keeps_event(self): | CODE |
| LOW⚡ | tests/test_ignore.py | 28 | def test_regex_match_and_miss(self): | CODE |
| LOW⚡ | tests/test_ignore.py | 35 | def test_invalid_regex_does_not_crash(self): | CODE |
| LOW⚡ | tests/test_ignore.py | 41 | def test_ignorelist_src_wildcards(self): | CODE |
| LOW⚡ | tests/test_debug_artifacts.py | 55 | def test_no_js_debugger_statement(self): | CODE |
| LOW⚡ | tests/test_debug_artifacts.py | 60 | def test_no_console_log_outside_the_vendored_bundle(self): | CODE |
| LOW⚡ | tests/test_debug_artifacts.py | 65 | def test_no_pdb_breakpoints_in_the_server(self): | CODE |
| LOW⚡ | tests/test_debug_artifacts.py | 71 | def test_shipped_config_keeps_the_safe_defaults(self): | CODE |
| LOW⚡ | tests/test_common.py | 59 | def test_common_affix_factoring(self): | CODE |
| LOW⚡ | tests/test_common.py | 63 | def test_metachars_escaped_literally(self): | CODE |
| LOW⚡ | tests/test_common.py | 73 | def test_builtin_ranges_match(self): | CODE |
| LOW⚡ | tests/test_common.py | 79 | def test_domain_not_range_matched(self): | CODE |
| LOW⚡ | tests/test_common.py | 83 | def test_exact_member_whitelisted(self): | CODE |
| LOW⚡ | tests/test_common.py | 211 | def test_a_pem_holding_a_known_bad_block_is_rejected(self): | CODE |
| LOW⚡ | tests/test_common.py | 216 | def test_the_key_is_recognised_without_its_original_certificate(self): | CODE |
| LOW⚡ | tests/test_common.py | 223 | def test_whitespace_and_block_order_do_not_matter(self): | CODE |
| LOW⚡ | tests/test_common.py | 228 | def test_an_unrelated_pem_is_accepted(self): | CODE |
| LOW⚡ | tests/test_common.py | 233 | def test_garbage_in_a_pem_block_is_not_a_crash(self): | CODE |
| LOW⚡ | tests/test_common.py | 241 | def test_an_unreadable_pem_is_neither_accepted_nor_rejected(self): | CODE |
| LOW⚡ | tests/test_common.py | 245 | def test_the_shipped_fingerprint_set_still_names_both_blocks(self): | CODE |
| LOW⚡ | tests/test_common.py | 316 | def test_missing_or_malformed_payload_is_a_non_answer_not_a_crash(self): | CODE |
| LOW⚡ | tests/test_common.py | 323 | def test_a_hit_costs_no_request(self): | CODE |
| LOW⚡ | tests/test_common.py | 329 | def test_a_failure_is_cached_too(self): | CODE |
| LOW⚡ | tests/test_common.py | 335 | def test_expiry_lets_a_lookup_retry(self): | CODE |
| LOW⚡ | tests/test_common.py | 345 | def test_the_cache_is_bounded(self): | CODE |
| LOW | tests/test_common.py | 38 | def test_public_and_boundaries(self): | CODE |
| LOW | tests/test_common.py | 122 | def test_non_aligned_cidr_whitelists_subnet(self): | CODE |
| LOW | tests/test_common.py | 299 | def test_geoloc_country_is_extracted_and_normalised(self): | CODE |
| LOW | tests/test_common.py | 305 | def test_a_country_that_is_not_a_country_code_is_dropped(self): | CODE |
| LOW | tests/test_common.py | 356 | def test_disabled_means_no_request_at_all(self): | CODE |
| LOW | tests/test_common.py | 362 | def test_an_unknown_kind_is_refused_before_any_request(self): | CODE |
| LOW | tests/test_quic_sni.py | 152 | def test_multibyte_packet_number(self): | CODE |
| LOW⚡ | tests/test_quic_sni.py | 169 | def test_multi_crypto_frame_reassembly(self): | CODE |
| LOW⚡ | tests/test_quic_sni.py | 176 | def test_multi_crypto_frame_out_of_order(self): | CODE |
| LOW⚡ | tests/test_quic_sni.py | 183 | def test_padding_and_ping_frames_skipped(self): | CODE |
| LOW⚡ | tests/test_quic_sni.py | 193 | def test_pure_python_decodes_crypto_encrypted(self): | CODE |
| LOW | tests/test_quic_sni.py | 206 | def test_prefix_cap_matches_full(self): | CODE |
| LOW | tests/test_quic_sni.py | 224 | def test_truncated_valid_packet(self): | CODE |
| LOW | tests/test_frontend.py | 44 | def test_every_column_has_a_cell(self): | CODE |
| LOW | tests/test_frontend.py | 59 | def test_empty_state_spans_every_column(self): | CODE |
| LOW | tests/test_frontend.py | 67 | def test_sortable_columns_are_sortable(self): | CODE |
| LOW | tests/test_frontend.py | 107 | def test_severity_of_real_events(self): | CODE |
| LOW | tests/test_frontend.py | 157 | def test_family_of_real_info_fields(self): | STRING |
| LOW | tests/test_frontend.py | 180 | def test_family_token_filters_rows(self): | STRING |
| LOW⚡ | tests/test_frontend.py | 225 | def test_canvas_is_sized_from_the_panel(self): | STRING |
| LOW⚡ | tests/test_frontend.py | 231 | def test_open_chart_follows_a_window_resize(self): | STRING |
| LOW⚡ | tests/test_frontend.py | 235 | def test_donut_and_legend_are_centred(self): | STRING |
| LOW | tests/test_frontend.py | 282 | def test_every_count_chart_labels_its_gridlines(self): | STRING |
| LOW | tests/test_frontend.py | 294 | def test_axis_ticks_are_whole_and_distinct(self): | STRING |
| LOW | tests/test_frontend.py | 337 | def test_the_whole_tag_set_is_editable_here(self): | CODE |
| LOW | tests/test_frontend.py | 344 | def test_sections_cover_the_event_tuple(self): | CODE |
| 304 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | server.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/update.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/geo.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/enums.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/trailsbin.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/compat.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/index.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/log.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/httpd.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/__init__.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/addr.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/assemble.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/ignore.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/common.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/custom_trails.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/settings.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/attribdict.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/provenance.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/parallel.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/testing.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/trailsdict.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/alert.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | core/meta.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | tests/test_index.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/rutgers.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/ciarmy.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/policeman.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/atmos.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/fareit.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/blocklist.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/abuseipdb.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/viriback.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/greensnow.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/myip.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/emergingthreatsdns.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/sslproxies.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/blackbook.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/statics.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/binarydefense.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/dshieldip.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/__init__.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/maxmind.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/minerchk.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/badips.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/sslblja3.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/bruteforceblocker.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/torprojectnodes.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/emergingthreatsbot.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/torproject.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/socksproxy.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/cybercrimetracker.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/emergingthreatscip.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/alienvault.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/ipnoise.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/bitcoinnodes.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/turris.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/feodotrackerip.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/cleantalk.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/sslblcert.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| HIGH | feeds/gpfcomics.py | 0 | copyright (c) 2014-2026 maltrail developers (https://github.com/stamparm/maltrail/) see the file 'license' for copying p | STRING |
| 7 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server.py | 184 | except Exception: | CODE |
| LOW | server.py | 203 | except Exception: | CODE |
| MEDIUM | core/update.py | 199 | def _cached_sha(): | CODE |
| MEDIUM | core/update.py | 698 | def update_ipcat(force=False): | CODE |
| LOW⚡ | core/update.py | 834 | except Exception: | CODE |
| LOW⚡ | core/update.py | 836 | except Exception as ex: | CODE |
| LOW⚡ | core/update.py | 844 | except Exception as ex: | CODE |
| LOW | core/update.py | 100 | except Exception as ex: | CODE |
| LOW | core/update.py | 148 | except Exception as ex: | CODE |
| LOW | core/update.py | 153 | except Exception: | CODE |
| LOW | core/update.py | 233 | except Exception as ex: | CODE |
| LOW | core/update.py | 316 | except Exception as ex: | CODE |
| LOW | core/update.py | 354 | except Exception as ex: | CODE |
| LOW | core/update.py | 374 | except Exception: | CODE |
| LOW | core/update.py | 472 | except Exception as ex: | CODE |
| LOW | core/update.py | 478 | except Exception: | CODE |
| LOW | core/update.py | 589 | except Exception: | CODE |
| LOW | core/update.py | 680 | except Exception as ex: | CODE |
| LOW | core/update.py | 688 | except Exception: | CODE |
| LOW | core/update.py | 702 | except Exception as ex: | CODE |
| LOW | core/update.py | 717 | except Exception as ex: | CODE |
| LOW | core/update.py | 739 | except Exception as ex: | CODE |
| LOW | core/update.py | 803 | except Exception as ex: | CODE |
| LOW | core/geo.py | 78 | except Exception: | CODE |
| LOW | core/geo.py | 94 | except Exception: | CODE |
| LOW | core/geo.py | 124 | except Exception: | CODE |
| LOW | core/geo.py | 153 | except Exception: | CODE |
| LOW | core/trailsbin.py | 124 | except Exception: | CODE |
| LOW | core/log.py | 225 | except Exception: | STRING |
| LOW | core/log.py | 397 | except Exception: | STRING |
| LOW | core/log.py | 427 | except Exception: | STRING |
| MEDIUM | core/log.py | 402 | def handle(self): | CODE |
| MEDIUM | core/httpd.py | 881 | def process_request_thread(self, request, client_address): | CODE |
| MEDIUM | core/httpd.py | 910 | def shutdown_request(self, request): | CODE |
| MEDIUM | core/httpd.py | 1076 | def do_POST(self): | CODE |
| LOW | core/httpd.py | 92 | except Exception: | CODE |
| LOW | core/httpd.py | 128 | except Exception: | CODE |
| LOW | core/httpd.py | 135 | except Exception: | CODE |
| LOW | core/httpd.py | 197 | except Exception: | CODE |
| LOW | core/httpd.py | 249 | except Exception: | CODE |
| LOW | core/httpd.py | 280 | except Exception: | CODE |
| LOW | core/httpd.py | 475 | except Exception: | CODE |
| LOW | core/httpd.py | 488 | except Exception: | CODE |
| LOW | core/httpd.py | 552 | except Exception: | CODE |
| LOW | core/httpd.py | 589 | except Exception: | CODE |
| LOW | core/httpd.py | 722 | except Exception: | CODE |
| LOW | core/httpd.py | 868 | except Exception: | CODE |
| LOW | core/httpd.py | 875 | except Exception: | CODE |
| LOW | core/httpd.py | 895 | except Exception: | CODE |
| LOW | core/httpd.py | 913 | except Exception: | CODE |
| LOW | core/httpd.py | 1073 | except Exception: | CODE |
| LOW | core/httpd.py | 1138 | except Exception: | CODE |
| LOW | core/httpd.py | 1155 | except Exception: | CODE |
| LOW | core/httpd.py | 1209 | except Exception: | CODE |
| LOW | core/httpd.py | 1221 | except Exception: | CODE |
| LOW | core/httpd.py | 1274 | except Exception: | CODE |
| LOW | core/httpd.py | 1375 | except Exception: | CODE |
| LOW | core/httpd.py | 1396 | except Exception: | CODE |
| LOW | core/httpd.py | 1443 | except Exception: | CODE |
| LOW | core/httpd.py | 1547 | except Exception: | CODE |
| 101 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install.sh | 1 | #!/bin/sh | COMMENT |
| LOW | ruff.toml | 1 | # Python linting, so the server is held to a comparable bar to the sensor's clippy -D warnings. | COMMENT |
| LOW | ruff.toml | 41 | # documented CPython thread-safety workaround, and a linter cannot know that). | COMMENT |
| LOW | docker/entrypoint.sh | 1 | #!/bin/sh | COMMENT |
| LOW | docker/entrypoint.sh | 101 | chown "$want_uid:$want_gid" "$d" 2>/dev/null || : | COMMENT |
| LOW | docker/tests/entrypoint_test.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | core/geo.py | 21 | from core.settings import GEO_IP2CC6_BUNDLED_FILE | COMMENT |
| LOW | core/trailsbin.py | 1 | #!/usr/bin/env python | COMMENT |
| LOW | core/log.py | 381 | # | COMMENT |
| LOW | core/httpd.py | 1001 | # third-party origin is allowed to execute code in the page that renders the | COMMENT |
| LOW | core/httpd.py | 1441 | return "%s(%s)" % (callback, payload) | COMMENT |
| LOW | core/assemble.py | 181 | COMMENT | |
| LOW | core/custom_trails.py | 21 | # This used to be a directory inside the checkout (trails/custom/) that pretended to be a feed: an | COMMENT |
| LOW | core/settings.py | 181 | DNS_TUNNELING_MIN_ENTROPY_X100 = 300 # bits/char x100: base32 ~500, hex ~400, English ~200 | COMMENT |
| LOW | core/provenance.py | 1 | #!/usr/bin/env python | COMMENT |
| LOW | core/alert.py | 21 | from core.settings import MAX_ALERT_THROTTLE_KEYS | COMMENT |
| LOW | core/meta.py | 21 | COMMENT | |
| LOW | tests/run.sh | 1 | #!/bin/sh | COMMENT |
| LOW | tests/canaries.txt | 1 | # Domains and addresses that must never be flagged by a static trail. | COMMENT |
| LOW | tests/canaries-allow.txt | 1 | # Trails that match a popular domain and are RIGHT anyway. | COMMENT |
| LOW | tests/install/run.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tests/install/soname.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tests/install/assert.sh | 1 | #!/bin/sh | COMMENT |
| LOW | sensor/Cargo.toml | 21 | # TPACKET_V3 mmap ring on Linux. | COMMENT |
| LOW | sensor/Cargo.toml | 41 | # digest that can match them. It is never used to authenticate anything. | COMMENT |
| LOW | sensor/deny.toml | 1 | # cargo-deny: the checks `cargo audit` does not do. | COMMENT |
| LOW | sensor/build.rs | 1 | //! Turn a missing libpcap into a sentence somebody can act on. | COMMENT |
| LOW | sensor/tools/check_redistribution.py | 61 | # door. EC2, EBS, WORKSPACES and the rest are single-tenant and stay eligible for listing. GCP's | COMMENT |
| LOW | sensor/tools/check_trails.py | 261 | # A dotless key is a bare-TLD trail (the `.xyz` entries in suspicious/domain.txt, with the | COMMENT |
| LOW | sensor/tools/check_trails.py | 281 | # leading dot - `.tk`, `.xyz`, `.cf` - which the loader strips and which this reads as "yes, | COMMENT |
| LOW | sensor/tools/check_trails.py | 401 | if verdict: | COMMENT |
| LOW | sensor/tools/gen_corpus.py | 601 | # 34. Two DIFFERENT DNS queries back-to-back on one socket in one second. sensor.py's burst | COMMENT |
| LOW | sensor/tools/gen_corpus.py | 801 | # A host/path trail whose BARE PATH is also a trail in its own right never produces the | COMMENT |
| LOW | sensor/tools/check.sh | 1 | #!/bin/sh | COMMENT |
| LOW | sensor/tools/check.sh | 41 | echo "== generated files are in sync with core/settings.py and data/ua.txt ==" | COMMENT |
| LOW | sensor/tests/loader_parity.rs | 1 | //! Differential loader test: the Rust loader vs `core.common.load_trails()`, on the REAL | COMMENT |
| LOW | sensor/tests/trails.rs | 441 | let (db2, _) = trails::load(&second, &wl).unwrap(); | COMMENT |
| LOW | sensor/tests/bounded_state.rs | 1 | //! Bounded state (ROADMAP Gate 1.5). | COMMENT |
| LOW | sensor/tests/fail_closed.rs | 181 | /// A capture that OPENS but cannot be read must not replay to "success" with zero packets. | COMMENT |
| LOW | sensor/tests/config_ranges.rs | 1 | //! Numeric option bounds (ROADMAP Gate 1.6). | COMMENT |
| LOW | sensor/tests/multi_pcap.rs | 1 | //! Multi-file offline replay shares one detection state (ROADMAP Gate 1.3). | COMMENT |
| LOW | sensor/tests/fuzz_parsers.rs | 1 | //! Deterministic fuzzing of every packet parser and of the whole packet path. | COMMENT |
| LOW | sensor/tests/generated.rs | 1 | //! Generated-file freshness. | COMMENT |
| LOW | sensor/tests/generated.rs | 141 | /// The `pub const ...` declaration inside one `;\n`-delimited chunk, or `None`. | COMMENT |
| LOW | sensor/tests/multi_worker_parity.rs | 1 | //! Multi-worker parity (ROADMAP Gate 2.2). | COMMENT |
| LOW | sensor/tests/meta.rs | 1 | //! The condensed observable store, end to end (`src/meta.rs` <-> `core/meta.py`). | COMMENT |
| LOW | sensor/tests/trail_update.rs | 1 | //! The sensor must REFRESH `trails.csv` itself, like `sensor.py:init():update_timer()` does. | COMMENT |
| LOW | sensor/tests/replay.rs | 1 | //! Offline pcap replay over the shipped corpus, through the real capture handle and DLT | COMMENT |
| LOW | sensor/benches/hotpath.rs | 1 | //! Reproducible benchmarks for the Rust sensor's packet path. | COMMENT |
| LOW | sensor/src/addr.rs | 1 | //! Address helpers, byte-for-byte compatible with `core/addr.py`. | COMMENT |
| LOW | sensor/src/trailupdate.rs | 1 | //! Trail updating — `sensor.py:init():update_timer()`. | COMMENT |
| LOW | sensor/src/pyre.rs | 1 | //! Python `re` compatibility shims. | COMMENT |
| LOW | sensor/src/config.rs | 41 | /// packets/s it dropped over 90% of offered traffic, taking 63% of injected detections with it. | COMMENT |
| LOW | sensor/src/config.rs | 161 | /// externally, e.g. pushed by the Maltrail server). Default OFF, i.e. the sensor refreshes | COMMENT |
| LOW | sensor/src/config.rs | 681 | // running fewer workers than PROCESS_COUNT wrote proportionally fewer lines for the same | COMMENT |
| LOW | sensor/src/config.rs | 721 | // detection. A dropped packet is never seen by any of the detection logic, so this is the | COMMENT |
| LOW | sensor/src/config.rs | 861 | /// Force every numeric option into a range the sensor can actually operate in, recording | COMMENT |
| LOW | sensor/src/worker.rs | 81 | /// This is what `-r a.pcap,b.pcap` must do. Giving each file its own worker also gave it its own | COMMENT |
| LOW | sensor/src/worker.rs | 221 | } | COMMENT |
| LOW | sensor/src/worker.rs | 281 | // Close throttle windows on the same coarse tick. | COMMENT |
| 49 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | install.sh | 148 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 150 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 208 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 210 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 258 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 260 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 439 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 441 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 552 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 554 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 590 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 592 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | install.sh | 622 | # --------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | core/quic_sni.py | 39 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | core/quic_sni.py | 41 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | core/quic_sni.py | 139 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | core/quic_sni.py | 141 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | core/quic_sni.py | 182 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | core/quic_sni.py | 184 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | core/quic_sni.py | 233 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | core/quic_sni.py | 235 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | core/tls_intel.py | 104 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | core/tls_intel.py | 106 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | core/tls_intel.py | 275 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | core/tls_intel.py | 277 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | core/tls_intel.py | 380 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | core/tls_intel.py | 382 | # --------------------------------------------------------------------------- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | core/update.py | 157 | CODE | |
| LOW | core/update.py | 342 | CODE | |
| LOW | core/update.py | 698 | CODE | |
| LOW | core/update.py | 792 | CODE | |
| LOW | core/update.py | 850 | CODE | |
| LOW | core/index.py | 98 | CODE | |
| LOW | core/log.py | 54 | CODE | |
| LOW | core/log.py | 119 | CODE | |
| LOW | core/log.py | 257 | CODE | |
| LOW | core/log.py | 330 | CODE | |
| LOW | core/httpd.py | 148 | CODE | |
| LOW | core/httpd.py | 447 | CODE | |
| LOW | core/httpd.py | 494 | CODE | |
| LOW | core/httpd.py | 728 | CODE | |
| LOW | core/httpd.py | 829 | CODE | |
| LOW | core/httpd.py | 919 | CODE | |
| LOW | core/httpd.py | 1091 | CODE | |
| LOW | core/httpd.py | 1142 | CODE | |
| LOW | core/httpd.py | 1231 | CODE | |
| LOW | core/httpd.py | 1503 | CODE | |
| LOW | core/httpd.py | 1721 | CODE | |
| LOW | core/httpd.py | 1780 | CODE | |
| LOW | core/httpd.py | 1828 | CODE | |
| LOW | core/httpd.py | 1941 | CODE | |
| LOW | core/httpd.py | 1959 | CODE | |
| LOW | core/httpd.py | 2049 | CODE | |
| LOW | core/httpd.py | 2202 | CODE | |
| LOW | core/httpd.py | 2294 | CODE | |
| LOW | core/httpd.py | 2382 | CODE | |
| LOW | core/httpd.py | 2467 | CODE | |
| LOW | core/addr.py | 108 | CODE | |
| LOW | core/quic_sni.py | 338 | CODE | |
| LOW | core/quic_sni.py | 377 | CODE | |
| LOW | core/assemble.py | 109 | CODE | |
| LOW | core/common.py | 66 | CODE | |
| LOW | core/common.py | 155 | CODE | |
| LOW | core/common.py | 231 | CODE | |
| LOW | core/common.py | 382 | CODE | |
| LOW | core/common.py | 446 | CODE | |
| LOW | core/common.py | 464 | CODE | |
| LOW | core/common.py | 493 | CODE | |
| LOW | core/common.py | 530 | CODE | |
| LOW | core/common.py | 701 | CODE | |
| LOW | core/common.py | 407 | CODE | |
| LOW | core/custom_trails.py | 34 | CODE | |
| LOW | core/settings.py | 413 | CODE | |
| LOW | core/settings.py | 593 | CODE | |
| LOW | core/settings.py | 606 | CODE | |
| LOW | core/settings.py | 626 | CODE | |
| LOW | core/parallel.py | 65 | CODE | |
| LOW | core/parallel.py | 83 | CODE | |
| LOW | core/testing.py | 285 | CODE | |
| LOW | core/tls_intel.py | 118 | CODE | |
| LOW | core/tls_intel.py | 326 | CODE | |
| LOW | core/meta.py | 213 | CODE | |
| LOW | tests/test_quic_sni.py | 230 | CODE | |
| LOW | tests/test_tls_intel.py | 204 | CODE | |
| LOW | tests/test_adversarial.py | 83 | CODE | |
| LOW | tests/test_httpd.py | 818 | CODE | |
| LOW | tests/test_httpd.py | 874 | CODE | |
| 24 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server.py | 16 | CODE | |
| LOW | server.py | 37 | CODE | |
| LOW | core/update.py | 59 | CODE | |
| LOW | core/update.py | 60 | CODE | |
| LOW | core/update.py | 61 | CODE | |
| LOW | core/update.py | 62 | CODE | |
| LOW | core/geo.py | 12 | CODE | |
| LOW | core/trailsbin.py | 25 | CODE | |
| LOW | core/httpd.py | 21 | CODE | |
| LOW | core/httpd.py | 76 | CODE | |
| LOW | core/httpd.py | 77 | CODE | |
| LOW | core/httpd.py | 78 | CODE | |
| LOW | core/httpd.py | 79 | CODE | |
| LOW | core/httpd.py | 85 | CODE | |
| LOW | core/quic_sni.py | 23 | CODE | |
| LOW | core/assemble.py | 8 | CODE | |
| LOW | core/common.py | 44 | CODE | |
| LOW | core/common.py | 45 | CODE | |
| LOW | core/common.py | 46 | CODE | |
| LOW | core/common.py | 47 | CODE | |
| LOW | core/settings.py | 23 | CODE | |
| LOW | core/settings.py | 24 | CODE | |
| LOW | core/settings.py | 25 | CODE | |
| LOW | core/settings.py | 26 | CODE | |
| LOW | core/trailsdict.py | 8 | CODE | |
| LOW | core/tls_intel.py | 20 | CODE | |
| LOW | core/tls_intel.py | 21 | CODE | |
| LOW | tests/test_alert.py | 11 | CODE | |
| LOW | tests/test_adversarial.py | 13 | CODE | |
| LOW | tests/test_refs.py | 12 | CODE | |
| LOW | tests/test_refs.py | 16 | CODE | |
| LOW | tests/test_config.py | 108 | CODE | |
| LOW | feeds/maxmind.py | 8 | CODE | |
| LOW | feeds/cleantalk.py | 8 | CODE | |
| LOW | sensor/tools/check_redistribution.py | 32 | CODE | |
| LOW | sensor/tools/gen_vectors.py | 19 | CODE | |
| LOW | sensor/tools/gen_vectors.py | 30 | CODE | |
| LOW | sensor/tools/gen_vectors.py | 31 | CODE | |
| LOW | sensor/tools/gen_vectors.py | 32 | CODE | |
| LOW | sensor/tools/gen_vectors.py | 33 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | docker/tests/entrypoint_test.sh | 13 | # It builds a small harness image rather than the real one: the entrypoint is the thing under | COMMENT |
| MEDIUM | docker/tests/entrypoint_test.sh | 15 | # harness copies the same entrypoint into the same directory layout, with a stub named | COMMENT |
| MEDIUM | sensor/tools/gen_corpus.py | 225 | # mode BOTH sensors stay silent here; the harness asserts these with --timestamps pcap. | COMMENT |
| MEDIUM | sensor/tools/gen_corpus.py | 242 | # breaks the harness instead of quietly restoring "parity" with a detection hole. | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 44 | # disagree in a way the parity harness structurally cannot see, because each is internally | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 305 | # This runs against a real daemon and takes about a minute: it builds a small harness image | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 327 | fetch-depth: 0 # the harness serves the clone from this checkout over file:// | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_frontend.py | 197 | function portDir() { return null; } function hay(t) { return (t.info + " " + t.trail).toLowerCase(); } | CODE |
| HIGH | tests/test_frontend.py | 249 | for (var i = 0; i < 10; i++) slices.push({ k: "threat" + i, v: 100 - i }); | CODE |
| HIGH | tests/test_frontend.py | 316 | if (i && v <= t[i - 1]) die("not ascending"); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sensor/src/addr.rs | 142 | // Step 1: re.findall("(?:0000:)+", address) -> maximal runs of the 5-byte unit | COMMENT |
| LOW | sensor/src/addr.rs | 179 | // Step 2: re.sub(r"(\A|:)0+(\w)", r"\g<1>\g<2>", address) | COMMENT |
| LOW | sensor/src/addr.rs | 223 | // Step 3: a collapsed leading run yields a single ':' -> make it '::'. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sensor/src/addr.rs | 142 | // Step 1: re.findall("(?:0000:)+", address) -> maximal runs of the 5-byte unit | COMMENT |
| LOW | sensor/src/addr.rs | 179 | // Step 2: re.sub(r"(\A|:)0+(\w)", r"\g<1>\g<2>", address) | COMMENT |
| LOW | sensor/src/addr.rs | 223 | // Step 3: a collapsed leading run yields a single ':' -> make it '::'. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_tls_intel.py | 23 | CODE | |
| LOW | sensor/tools/gen_ja_vectors.py | 36 | CODE |