🧱 easy, fast and local-first microVM runtime
This report presents the forensic synthetic code analysis of superradcompany/microsandbox, a Rust project with 6,920 GitHub stars. SynthScan v2.0 examined 270,602 lines of code across 863 source files, recording 1050 pattern matches distributed across 16 syntactic categories. The overall adjusted score of 5.3 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 1050 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | deny.toml | 1 | # This template contains all of the possible sections and their default values | COMMENT |
| LOW | deny.toml | 21 | targets = [ | COMMENT |
| LOW | deny.toml | 41 | # The lint level for unmaintained crates | COMMENT |
| LOW | deny.toml | 81 | ] | COMMENT |
| LOW | deny.toml | 141 | # This section is considered when running `cargo deny check bans`. | COMMENT |
| LOW | deny.toml | 181 | { name = "windows_x86_64_gnu" }, | COMMENT |
| LOW | deny.toml | 201 | # in the allow list is encountered | COMMENT |
| LOW | AGENTS.md | 121 | - Use the exact section delimiter shown below. Do not invent alternate Markdown-style, shorter, or decorative section he | COMMENT |
| LOW | AGENTS.md | 141 | COMMENT | |
| LOW | .config/nextest.toml | 1 | # nextest configuration. | COMMENT |
| LOW | crates/metrics/lib/layout.rs | 1 | //! Binary layout of the shared-memory metrics registry. | COMMENT |
| LOW | crates/metrics/lib/layout.rs | 21 | //! | 0x08 version u32 layout version (3) | | COMMENT |
| LOW | crates/metrics/lib/layout.rs | 41 | //! | 0x30 sampled_at_ms AI64 0 until first sample | | COMMENT |
| LOW | crates/metrics/lib/layout.rs | 61 | //! | 0x130 _tail [u8; 208] | | COMMENT |
| LOW | crates/metrics/lib/layout.rs | 81 | COMMENT | |
| LOW | crates/metrics/lib/layout.rs | 101 | COMMENT | |
| LOW | crates/metrics/lib/layout.rs | 121 | /// Header state: the creating process is still writing the header. | COMMENT |
| LOW | crates/metrics/lib/layout.rs | 141 | // Constants: Sample flags | COMMENT |
| LOW | crates/metrics/lib/layout.rs | 161 | //-------------------------------------------------------------------------------------------------- | COMMENT |
| LOW | crates/metrics/lib/layout.rs | 201 | /// Catalog run id of the current owner. `0` while reserved. | COMMENT |
| LOW | crates/metrics/lib/layout.rs | 241 | /// Length of the bytes in `name_bytes` that are valid UTF-8 name data. | COMMENT |
| LOW | crates/metrics/lib/registry.rs | 41 | //-------------------------------------------------------------------------------------------------- | COMMENT |
| LOW | crates/metrics/lib/registry.rs | 121 | /// Cloneable handle (`Arc`-backed). Dropping the last clone unmaps the region | COMMENT |
| LOW | crates/metrics/lib/registry.rs | 381 | COMMENT | |
| LOW | crates/metrics/lib/error.rs | 1 | //! Error type used by the metrics registry. | COMMENT |
| LOW | crates/metrics/lib/lib.rs | 1 | //! Shared-memory live metrics registry for microsandbox. | COMMENT |
| LOW | crates/metrics/lib/snapshot.rs | 1 | //! In-memory snapshot types produced by registry reads. | COMMENT |
| LOW | crates/metrics/lib/snapshot.rs | 21 | /// Carries both identity (sandbox_id, run_id, pid, name) and the metric | COMMENT |
| LOW | crates/test-utils/src/lib.rs | 1 | //! Internal test helpers for microsandbox integration tests. | COMMENT |
| LOW | crates/test-utils/src/lib.rs | 21 | pub use test_macros::msb_test; | COMMENT |
| LOW | crates/network/lib/proxy.rs | 841 | .parse::<u16>() | COMMENT |
| LOW | crates/network/lib/proxy.rs | 881 | /// Finish classifying the guest's first flight after the upstream socket is | COMMENT |
| LOW | crates/network/lib/device.rs | 1 | //! Slot-based [`smoltcp::phy::Device`] implementation. | COMMENT |
| LOW | crates/network/lib/device.rs | 21 | //-------------------------------------------------------------------------------------------------- | COMMENT |
| LOW | crates/network/lib/icmp_error.rs | 21 | COMMENT | |
| LOW | crates/network/lib/config.rs | 21 | /// Complete network configuration for a sandbox. | COMMENT |
| LOW | crates/network/lib/config.rs | 61 | /// Ship the host's trusted root CAs into the guest at boot so outbound | COMMENT |
| LOW | crates/network/lib/config.rs | 101 | /// DNS interception settings for the sandbox. | COMMENT |
| LOW | crates/network/lib/backend.rs | 1 | //! `SmoltcpBackend` — libkrun [`NetBackend`] implementation that bridges the | COMMENT |
| LOW | crates/network/lib/backend.rs | 21 | COMMENT | |
| LOW | crates/network/lib/icmp_relay.rs | 41 | const IPV6_HDR_LEN: usize = 40; | COMMENT |
| LOW | crates/network/lib/icmp_relay.rs | 321 | } | COMMENT |
| LOW | crates/network/lib/publisher.rs | 81 | /// Spawns tokio listeners for each published port. When connections arrive, | COMMENT |
| LOW | crates/network/lib/conn.rs | 41 | /// Terminal connection status reported by an outbound proxy task. | COMMENT |
| LOW | crates/network/lib/conn.rs | 61 | } | COMMENT |
| LOW | crates/network/lib/conn.rs | 121 | /// Information for spawning a proxy task for a newly established connection. | COMMENT |
| LOW | crates/network/lib/conn.rs | 201 | } | COMMENT |
| LOW | crates/network/lib/stack.rs | 61 | /// Pre-inspection allows the poll loop to: | COMMENT |
| LOW | crates/network/lib/stack.rs | 181 | COMMENT | |
| LOW | crates/network/lib/stack.rs | 201 | /// | COMMENT |
| LOW | crates/network/lib/stack.rs | 341 | // DoT: intercept only when TLS MITM is | COMMENT |
| LOW | crates/network/lib/stack.rs | 501 | tls_state.clone(), | COMMENT |
| LOW | crates/network/lib/stack.rs | 781 | COMMENT | |
| LOW | crates/network/lib/network.rs | 21 | use crate::tls::state::TlsState; | COMMENT |
| LOW | crates/network/lib/network.rs | 81 | //-------------------------------------------------------------------------------------------------- | COMMENT |
| LOW | crates/network/lib/builder.rs | 441 | self | COMMENT |
| LOW | crates/network/lib/shared.rs | 21 | //-------------------------------------------------------------------------------------------------- | COMMENT |
| LOW | crates/network/lib/shared.rs | 41 | /// Queue naming follows the **guest's perspective** (matching libkrun's | COMMENT |
| LOW | crates/network/lib/udp_relay.rs | 121 | self.payload.len() + self.original_ip_packet.len() | COMMENT |
| LOW | crates/network/lib/udp_relay.rs | 361 | //-------------------------------------------------------------------------------------------------- | COMMENT |
| 568 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/network/lib/proxy.rs | 1450 | // ── extract_http_host ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/network/lib/proxy.rs | 1500 | // ── plain-HTTP secret substitution ──────────────────────────────────────── | COMMENT |
| MEDIUM | crates/network/lib/stack.rs | 322 | // ── Phase 1: Drain all guest frames with pre-inspection ────────── | COMMENT |
| MEDIUM | crates/network/lib/stack.rs | 455 | // ── Phase 2: Ingress egress + maintenance ───────────────────────── | COMMENT |
| MEDIUM | crates/network/lib/stack.rs | 472 | // ── Phase 3: Service connections + relay data ──────────────────── | COMMENT |
| MEDIUM | crates/network/lib/stack.rs | 587 | // ── Phase 4: Flush relay data + sleep ──────────────────────────── | COMMENT |
| MEDIUM | crates/image/lib/cache/store.rs | 172 | // ── Layer EROFS paths (keyed by diff_id) ───────────────────────── | COMMENT |
| MEDIUM | crates/image/lib/cache/store.rs | 201 | // ── fsmeta EROFS paths (keyed by manifest digest) ───────────────── | COMMENT |
| MEDIUM | crates/image/lib/cache/store.rs | 225 | // ── VMDK descriptor paths (keyed by manifest digest) ──────────── | COMMENT |
| MEDIUM | crates/image/lib/cache/store.rs | 249 | // ── Staging/tmp paths (downloads, work dirs) ───────────────────── | COMMENT |
| MEDIUM | crates/image/lib/cache/store.rs | 273 | // ── Manifest metadata cache ────────────────────────────────────── | COMMENT |
| MEDIUM | crates/image/lib/cache/store.rs | 391 | // ── Blob cache paths ────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | crates/metrics-collector/lib/lib.rs | 28 | //! ┌─ run loop ─────────────────────────────────────────────┐ | COMMENT |
| MEDIUM⚡ | crates/metrics-collector/lib/lib.rs | 32 | //! └────┬───────────────────────────────────────┬───────────┘ | COMMENT |
| MEDIUM⚡ | crates/metrics-collector/lib/lib.rs | 38 | //! ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ | COMMENT |
| MEDIUM⚡ | crates/metrics-collector/lib/lib.rs | 44 | //! └──────┬──────┘ └──────┬──────┘ └──────┬──────┘ | COMMENT |
| MEDIUM | …s/migration/lib/m20260410_000001_erofs_image_schema.rs | 154 | // ── Drop old tables (FK-safe order) ────────────────────────────── | COMMENT |
| MEDIUM | …s/migration/lib/m20260410_000001_erofs_image_schema.rs | 193 | // ── Create new tables ──────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/config.rs | 1129 | // ── Block Root ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/config.rs | 1238 | // ── File Mounts ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/config.rs | 1287 | // ── Tmpfs ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/config.rs | 1312 | // ── Disk Mounts ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/config.rs | 1434 | // ── Network ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/config.rs | 1529 | // ── Rlimits ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/config.rs | 1575 | // ── Handoff Init ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/network.rs | 227 | // ── ioctl helpers ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/network.rs | 323 | // ── netlink helpers ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/network.rs | 531 | // ── hostname + hosts + resolv.conf ────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/network.rs | 593 | // ── low-level helpers ────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/network.rs | 625 | // ── netlink constants and helpers ────────────────────────────────── | COMMENT |
| MEDIUM | sdk/python/microsandbox/events.py | 8 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/events.py | 10 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/events.py | 34 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/events.py | 36 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | sdk/python/microsandbox/types.py | 10 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | sdk/python/microsandbox/types.py | 12 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | sdk/python/microsandbox/types.py | 17 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | sdk/python/microsandbox/types.py | 19 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | sdk/python/microsandbox/types.py | 203 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | sdk/python/microsandbox/types.py | 205 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | sdk/python/microsandbox/types.py | 213 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | sdk/python/microsandbox/types.py | 215 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 182 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 184 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 255 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 257 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 277 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 279 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 307 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 309 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 395 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 397 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 502 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 504 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 568 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 570 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 648 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 650 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 981 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 983 | #-------------------------------------------------------------------------------------------------- | COMMENT |
| 77 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | sdk/python/integration/test_volumes.py | 58 | "dd if=/dev/zero of=/scratch/small bs=1M count=1 status=none && echo small-ok", | CODE |
| HIGH | sdk/python/integration/test_network.py | 73 | "nc -zv -w 5 1.1.1.1 443 >/dev/null 2>&1 || echo cloudflare-failed; " | CODE |
| HIGH | sdk/python/integration/test_network.py | 74 | "nc -zv -w 5 8.8.8.8 443 >/dev/null 2>&1 || echo google-failed" | CODE |
| HIGH | sdk/python/integration/test_patches.py | 23 | "test -d /opt/py-sdk && cat /opt/py-sdk/config.txt && cat /opt/py-sdk/link.txt" | CODE |
| HIGH⚡ | examples/python/net-secrets/main.py | 28 | "wget -q -O /dev/null --timeout=10 https://example.com && echo OK || echo FAIL" | CODE |
| HIGH⚡ | examples/python/net-secrets/main.py | 28 | "wget -q -O /dev/null --timeout=10 https://example.com && echo OK || echo FAIL" | CODE |
| HIGH⚡ | examples/python/net-secrets/main.py | 36 | "https://cloudflare.com 2>&1 && echo OK || echo BLOCKED" | CODE |
| HIGH⚡ | examples/python/net-secrets/main.py | 36 | "https://cloudflare.com 2>&1 && echo OK || echo BLOCKED" | CODE |
| HIGH | examples/python/net-tls/main.py | 18 | output = await sb.shell("ls /.msb/tls/ca.pem 2>&1 && echo FOUND || echo MISSING") | CODE |
| HIGH | examples/python/net-tls/main.py | 18 | output = await sb.shell("ls /.msb/tls/ca.pem 2>&1 && echo FOUND || echo MISSING") | CODE |
| HIGH⚡ | examples/python/net-tls/main.py | 29 | output = await sb.shell("wget -q -O /dev/null --timeout=5 http://example.com && echo OK || echo FAIL") | CODE |
| HIGH⚡ | examples/python/net-tls/main.py | 29 | output = await sb.shell("wget -q -O /dev/null --timeout=5 http://example.com && echo OK || echo FAIL") | CODE |
| HIGH⚡ | examples/python/net-tls/main.py | 35 | "wget -q -O /dev/null --timeout=10 https://example.com 2>&1 && echo OK || echo FAIL" | CODE |
| HIGH⚡ | examples/python/net-tls/main.py | 35 | "wget -q -O /dev/null --timeout=10 https://example.com 2>&1 && echo OK || echo FAIL" | CODE |
| HIGH⚡ | examples/python/net-tls/main.py | 41 | "wget --no-check-certificate -q -O /dev/null --timeout=10 https://example.com 2>&1 && echo OK || echo FAIL" | CODE |
| HIGH⚡ | examples/python/net-tls/main.py | 41 | "wget --no-check-certificate -q -O /dev/null --timeout=10 https://example.com 2>&1 && echo OK || echo FAIL" | CODE |
| HIGH | examples/python/net-policy/main.py | 17 | output = await sb.shell("wget -q -O /dev/null --timeout=5 http://example.com && echo OK || echo FAIL") | CODE |
| HIGH | examples/python/net-policy/main.py | 17 | output = await sb.shell("wget -q -O /dev/null --timeout=5 http://example.com && echo OK || echo FAIL") | CODE |
| HIGH | examples/python/net-policy/main.py | 30 | output = await sb.shell("wget -q -O /dev/null --timeout=5 http://example.com && echo OK || echo FAIL") | CODE |
| HIGH | examples/python/net-policy/main.py | 30 | output = await sb.shell("wget -q -O /dev/null --timeout=5 http://example.com && echo OK || echo FAIL") | CODE |
| HIGH | examples/python/net-policy/main.py | 43 | output = await sb.shell("wget -q -O /dev/null --timeout=3 http://example.com && echo OK || echo BLOCKED") | CODE |
| HIGH | examples/python/net-policy/main.py | 43 | output = await sb.shell("wget -q -O /dev/null --timeout=3 http://example.com && echo OK || echo BLOCKED") | CODE |
| HIGH⚡ | examples/python/net-dns/main.py | 22 | output = await sb.shell("nslookup example.com 2>&1 | grep -c Address || echo 0") | CODE |
| HIGH⚡ | examples/python/net-dns/main.py | 26 | output = await sb.shell("nslookup blocked.example.com 2>&1 && echo RESOLVED || echo BLOCKED") | CODE |
| HIGH⚡ | examples/python/net-dns/main.py | 26 | output = await sb.shell("nslookup blocked.example.com 2>&1 && echo RESOLVED || echo BLOCKED") | CODE |
| HIGH⚡ | examples/python/net-dns/main.py | 30 | output = await sb.shell("nslookup anything.evil.com 2>&1 && echo RESOLVED || echo BLOCKED") | CODE |
| HIGH⚡ | examples/python/net-dns/main.py | 30 | output = await sb.shell("nslookup anything.evil.com 2>&1 && echo RESOLVED || echo BLOCKED") | CODE |
| HIGH⚡ | examples/python/net-dns/main.py | 34 | output = await sb.shell("nslookup cloudflare.com 2>&1 | grep -c Address || echo 0") | CODE |
| HIGH | examples/python/snapshot-fork/main.py | 16 | await baseline.shell("echo 'shipped via snapshot' > /root/marker.txt && sync") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sdk/python/integration/test_create_kwargs.py | 3 | CODE | |
| LOW | sdk/python/integration/test_lifecycle.py | 3 | CODE | |
| LOW | sdk/python/integration/conftest.py | 3 | CODE | |
| LOW | sdk/python/integration/test_images.py | 1 | CODE | |
| LOW | sdk/python/integration/test_metrics_logs.py | 3 | CODE | |
| LOW | sdk/python/integration/test_volumes.py | 3 | CODE | |
| LOW | sdk/python/integration/test_exec.py | 3 | CODE | |
| LOW | sdk/python/integration/test_fs.py | 3 | CODE | |
| LOW | sdk/python/integration/test_network.py | 3 | CODE | |
| LOW | sdk/python/integration/test_snapshots.py | 3 | CODE | |
| LOW | sdk/python/integration/test_patches.py | 3 | CODE | |
| LOW | sdk/python/integration/helpers.py | 3 | CODE | |
| LOW | sdk/python/integration/test_pull_progress.py | 3 | CODE | |
| LOW | sdk/python/tests/test_image_source.py | 3 | CODE | |
| LOW | sdk/python/tests/test_mount_policies.py | 7 | CODE | |
| LOW | sdk/python/tests/test_image_archive.py | 3 | CODE | |
| LOW | sdk/python/tests/test_modify_stub.py | 3 | CODE | |
| LOW | sdk/python/tests/test_pull_session.py | 3 | CODE | |
| LOW | sdk/python/tests/test_secret_passthrough.py | 3 | CODE | |
| LOW | sdk/python/tests/test_network_destinations.py | 3 | CODE | |
| LOW | sdk/python/tests/test_runtime_binary.py | 3 | CODE | |
| LOW | sdk/python/microsandbox/events.py | 3 | CODE | |
| LOW | sdk/python/microsandbox/_cli.py | 8 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| 97 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sdk/python/integration/test_create_kwargs.py | 19 | async def test_create_kwargs_affect_guest_defaults(sandbox_name): | CODE |
| LOW | sdk/python/integration/test_create_kwargs.py | 58 | async def test_create_kwargs_round_trip_through_config_json(sandbox_name): | CODE |
| LOW | sdk/python/integration/test_create_kwargs.py | 151 | async def test_create_kwargs_validate_bad_values(sandbox_name, kwargs, message): | CODE |
| LOW | sdk/python/integration/test_lifecycle.py | 20 | async def test_create_get_list_connect_stop_start_and_remove(sandbox_name): | CODE |
| LOW | sdk/python/integration/test_lifecycle.py | 109 | async def test_replace_rejects_duplicate_then_replaces(sandbox_name): | CODE |
| LOW⚡ | sdk/python/integration/test_images.py | 9 | async def test_image_list_returns_cached_handles() -> None: | CODE |
| LOW⚡ | sdk/python/integration/test_images.py | 19 | async def test_image_get_missing_raises_typed_error() -> None: | CODE |
| LOW⚡ | sdk/python/integration/test_images.py | 24 | async def test_image_save_missing_raises_typed_error(tmp_path) -> None: | CODE |
| LOW⚡ | sdk/python/integration/test_images.py | 32 | async def test_image_save_and_load_round_trips_archive(sandbox_factory, tmp_path) -> None: | CODE |
| LOW | sdk/python/integration/test_images.py | 54 | async def test_image_management_round_trips_pulled_sandbox_image(sandbox_factory) -> None: | CODE |
| LOW | sdk/python/integration/test_metrics_logs.py | 33 | async def test_metrics_snapshot_stream_and_all_sandbox_metrics(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_metrics_logs.py | 55 | async def test_logs_snapshot_filters_and_stream_resume(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_volumes.py | 11 | async def test_volume_lifecycle_metadata_and_host_fs(volume_factory): | CODE |
| LOW | sdk/python/integration/test_volumes.py | 36 | async def test_named_volume_mount_into_sandbox(volume_factory, sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_volumes.py | 51 | async def test_tmpfs_mount_enforces_size_limit(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_exec.py | 13 | async def test_exec_kwargs_and_options_dict(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_exec.py | 55 | async def test_shell_timeout_and_user_env_overrides(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_exec.py | 71 | async def test_exec_stream_iteration_collect_wait_and_signal(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_exec.py | 117 | async def test_exec_stream_missing_binary_surfaces_failure(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_exec.py | 132 | async def test_stdin_modes_and_take_stdin_contract(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_fs.py | 11 | async def test_fs_file_directory_and_metadata_operations(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_fs.py | 47 | async def test_fs_streams_and_host_copy_roundtrip(sandbox_factory, tmp_path): | CODE |
| LOW | sdk/python/integration/test_network.py | 23 | async def test_network_policy_and_port_config_create(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_network.py | 49 | async def test_ip_destination_allows_specific_egress(label, destination, sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_snapshots.py | 14 | async def test_snapshot_create_open_list_and_boot(sandbox_name): | CODE |
| LOW | sdk/python/integration/test_patches.py | 11 | async def test_rootfs_patches_are_applied(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_pull_progress.py | 14 | async def test_create_with_progress_emits_events_and_returns_sandbox(sandbox_name): | CODE |
| LOW | sdk/python/integration/test_pull_progress.py | 58 | async def test_create_with_progress_result_rejects_on_second_call(sandbox_name): | CODE |
| LOW | sdk/python/integration/test_pull_progress.py | 86 | async def test_create_with_progress_detached_returns_detached_sandbox(sandbox_name): | CODE |
| LOW | sdk/python/integration/test_pull_progress.py | 140 | async def test_create_with_progress_failure_surfaces_from_result(sandbox_name): | CODE |
| LOW⚡ | sdk/python/tests/test_image_source.py | 10 | def test_oci_accepts_root_disk_int() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_image_source.py | 20 | def test_oci_accepts_managed_root_disk() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_image_source.py | 27 | def test_oci_accepts_tmpfs_root_disk() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_image_source.py | 34 | def test_oci_accepts_disk_image_root_disk() -> None: | CODE |
| LOW | sdk/python/tests/test_image_source.py | 49 | def test_oci_accepts_deprecated_upper_size_mib_alias() -> None: | CODE |
| LOW | sdk/python/tests/test_image_source.py | 61 | def test_oci_rejects_root_disk_and_upper_size_mib_together() -> None: | CODE |
| LOW | sdk/python/tests/test_image_source.py | 66 | def test_image_namespace_includes_cache_management() -> None: | CODE |
| LOW | sdk/python/tests/test_mount_policies.py | 21 | def test_bind_default_omits_policies() -> None: | CODE |
| LOW | sdk/python/tests/test_mount_policies.py | 29 | def test_bind_accepts_policy_strings() -> None: | CODE |
| LOW | sdk/python/tests/test_mount_policies.py | 48 | def test_bind_serializes_security_mount_flags() -> None: | CODE |
| LOW | sdk/python/tests/test_mount_policies.py | 60 | def test_bind_with_relaxed_and_mirror_serializes_lowercase() -> None: | CODE |
| LOW | sdk/python/tests/test_mount_policies.py | 72 | def test_named_with_off_serializes() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_mount_policies.py | 84 | def test_tmpfs_rejects_stat_virt_at_serialization() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_mount_policies.py | 94 | def test_tmpfs_rejects_host_perms_at_serialization() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_mount_policies.py | 103 | def test_disk_rejects_stat_virt_at_serialization() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_mount_policies.py | 114 | def test_stat_virtualization_str_values() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_mount_policies.py | 120 | def test_host_permissions_str_values() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_mount_policies.py | 125 | def test_security_profile_str_values() -> None: | CODE |
| LOW | sdk/python/tests/test_image_archive.py | 12 | async def test_save_rejects_unknown_format(tmp_path: pathlib.Path) -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_modify_stub.py | 41 | def test_secret_modify_spec_stub_keys() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_modify_stub.py | 55 | def test_sandbox_modify_stub_signature() -> None: | CODE |
| LOW | sdk/python/tests/test_pull_session.py | 11 | async def test_create_with_progress_returns_session_outside_tokio_reactor() -> None: | CODE |
| LOW | sdk/python/tests/test_secret_passthrough.py | 8 | def test_violation_action_includes_passthrough() -> None: | CODE |
| LOW | sdk/python/tests/test_secret_passthrough.py | 12 | def test_secret_passthrough_hosts_serialize() -> None: | CODE |
| LOW | sdk/python/tests/test_secret_passthrough.py | 36 | def test_network_secret_passthrough_hosts_serialize() -> None: | CODE |
| LOW | sdk/python/tests/test_network_destinations.py | 8 | def test_typed_ip_destination_serializes_with_kind() -> None: | CODE |
| LOW | sdk/python/tests/test_network_destinations.py | 31 | def test_typed_group_destination_serializes_with_kind() -> None: | CODE |
| LOW | sdk/python/tests/test_network_destinations.py | 46 | def test_string_destination_remains_compatibility_shorthand() -> None: | CODE |
| LOW | sdk/python/tests/test_runtime_binary.py | 16 | def test_bridge_functions_are_exposed(): | CODE |
| LOW | sdk/python/tests/test_runtime_binary.py | 21 | def test_native_resolver_returns_bundled_path(): | CODE |
| 4 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | sdk/rust/lib/sandbox/builder.rs | 581 | self.config.spec.network.ports.push(PublishedPortSpec { | CODE |
| CRITICAL | sdk/rust/lib/sandbox/builder.rs | 1063 | super::validate_hostname(self.config.spec.runtime.hostname.as_deref())?; | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/network/lib/policy/name.rs | 266 | "user@example.com", // userinfo@host | CODE |
| LOW | sdk/go/modify_test.go | 134 | if apiKey["placeholder"] != "$API_KEY" { | CODE |
| LOW | sdk/go/modify_test.go | 135 | t.Fatalf("placeholder = %v", apiKey["placeholder"]) | CODE |
| LOW | sdk/go/native/src/lib.rs | 6200 | {"name":"API_KEY","source":{"kind":"env","var":"HOST_API_KEY"},"placeholder":"$API_KEY","allowed_hosts": | CODE |
| LOW⚡ | sdk/python/tests/test_modify_stub.py | 50 | assert keys == ["env", "value", "store", "placeholder", "allowed_hosts"] | CODE |
| LOW | sdk/python/microsandbox/types.py | 611 | d["placeholder"] = self.placeholder | CODE |
| LOW | sdk/python/src/sandbox_handle.rs | 151 | /// `"env"` / `"value"` / `"store"`, plus optional `"placeholder"` and | COMMENT |
| LOW | sdk/python/src/helpers.rs | 1201 | let placeholder: Option<String> = extract_opt(secret, "placeholder")?; | CODE |
| LOW | sdk/python/src/sandbox.rs | 642 | /// `"env"` / `"value"` / `"store"`, plus optional `"placeholder"` and | COMMENT |
| LOW | sdk/python/src/sandbox.rs | 1012 | "placeholder" => placeholder = Some(extract_secret_str(&name, "placeholder", obj)?), | CODE |
| LOW | sdk/python/src/sandbox.rs | 1888 | assert_eq!(secrets[0]["placeholder"], "$API_KEY"); | CODE |
| LOW | sdk/rust/lib/sandbox/modify.rs | 3403 | .is_some_and(|reason| reason.contains("placeholder")) | CODE |
| LOW | packages/microsandbox-types/rust/lib/domain.rs | 1840 | .field("placeholder", &self.placeholder) | CODE |
| LOW | packages/microsandbox-types/rust/lib/modify.rs | 407 | .field("placeholder", &self.placeholder) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/image/lib/registry/client.rs | 355 | // Step 1: Early cache check using persisted image metadata. | COMMENT |
| LOW | crates/image/lib/registry/client.rs | 395 | // Step 2: Resolve manifest. | COMMENT |
| LOW⚡ | crates/image/lib/registry/client.rs | 414 | // Step 3: Parse config. | COMMENT |
| LOW⚡ | crates/image/lib/registry/client.rs | 417 | // Step 4: Get layer descriptors. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/image/lib/registry/client.rs | 355 | // Step 1: Early cache check using persisted image metadata. | COMMENT |
| LOW | crates/image/lib/registry/client.rs | 395 | // Step 2: Resolve manifest. | COMMENT |
| LOW⚡ | crates/image/lib/registry/client.rs | 414 | // Step 3: Parse config. | COMMENT |
| LOW⚡ | crates/image/lib/registry/client.rs | 417 | // Step 4: Get layer descriptors. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | examples/python/volume-named/main.py | 9 | # Create a named volume. | COMMENT |
| MEDIUM | examples/python/fs-read-stream/main.py | 21 | # Create a 10 MiB file with random data inside the sandbox. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | packages/agent-client/rust/lib/stream.rs | 1 | //! Generic stream handle scaffold. | COMMENT |
| MEDIUM | packages/agent-client/rust/lib/stream.rs | 53 | /// This scaffold is intentionally not wired to a routing implementation yet. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | sdk/rust/Cargo.toml | 20 | # Exposes the archive walker to the fuzz harness (sdk/rust/fuzz). Never enabled in shipping builds. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sdk/python/integration/conftest.py | 35 | except Exception: | CODE |
| LOW | examples/python/net-ports/main.py | 34 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sdk/python/tests/test_modify_stub.py | 27 | CODE | |
| LOW | sdk/python/microsandbox/types.py | 336 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/bump-version.sh | 5 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sdk/python/microsandbox/__init__.py | 159 | __all__ = [ | CODE |