🧱 easy fast local-first microVM runtime and library
This report presents the forensic synthetic code analysis of superradcompany/microsandbox, a Rust project with 7,981 GitHub stars. SynthScan v2.0 examined 350,655 lines of code across 1001 source files, recording 1276 pattern matches distributed across 16 syntactic categories. The overall adjusted score of 4.9 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 1276 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | deny.toml | 1 | # This template contains all of the possible sections and their default values | COMMENT |
| LOW | deny.toml | 21 | targets = [ | COMMENT |
| LOW | deny.toml | 41 | # The lint level for unmaintained crates | COMMENT |
| LOW | deny.toml | 81 | ] | COMMENT |
| LOW | deny.toml | 141 | # This section is considered when running `cargo deny check bans`. | COMMENT |
| LOW | deny.toml | 181 | { name = "windows_x86_64_gnu" }, | COMMENT |
| LOW | deny.toml | 201 | # in the allow list is encountered | COMMENT |
| LOW | AGENTS.md | 161 | - Organize Rust files with these section headers, in this order when applicable: | COMMENT |
| LOW | AGENTS.md | 181 | // Functions | COMMENT |
| LOW | .config/nextest.toml | 1 | # nextest configuration. | COMMENT |
| LOW | crates/metrics/lib/layout.rs | 1 | //! Binary layout of the shared-memory metrics registry. | COMMENT |
| LOW | crates/metrics/lib/layout.rs | 21 | //! | 0x08 version u32 layout version (3) | | COMMENT |
| LOW | crates/metrics/lib/layout.rs | 41 | //! | 0x30 sampled_at_ms AI64 0 until first sample | | COMMENT |
| LOW | crates/metrics/lib/layout.rs | 61 | //! | 0x130 _tail [u8; 208] | | COMMENT |
| LOW | crates/metrics/lib/layout.rs | 81 | COMMENT | |
| LOW | crates/metrics/lib/layout.rs | 101 | COMMENT | |
| LOW | crates/metrics/lib/layout.rs | 121 | /// Header state: the creating process is still writing the header. | COMMENT |
| LOW | crates/metrics/lib/layout.rs | 141 | // Constants: Sample flags | COMMENT |
| LOW | crates/metrics/lib/layout.rs | 161 | //-------------------------------------------------------------------------------------------------- | COMMENT |
| LOW | crates/metrics/lib/layout.rs | 201 | /// Catalog run id of the current owner. `0` while reserved. | COMMENT |
| LOW | crates/metrics/lib/layout.rs | 241 | /// Length of the bytes in `name_bytes` that are valid UTF-8 name data. | COMMENT |
| LOW | crates/metrics/lib/registry.rs | 41 | //-------------------------------------------------------------------------------------------------- | COMMENT |
| LOW | crates/metrics/lib/registry.rs | 121 | /// Cloneable handle (`Arc`-backed). Dropping the last clone unmaps the region | COMMENT |
| LOW | crates/metrics/lib/registry.rs | 381 | COMMENT | |
| LOW | crates/metrics/lib/error.rs | 1 | //! Error type used by the metrics registry. | COMMENT |
| LOW | crates/metrics/lib/lib.rs | 1 | //! Shared-memory live metrics registry for microsandbox. | COMMENT |
| LOW | crates/metrics/lib/snapshot.rs | 1 | //! In-memory snapshot types produced by registry reads. | COMMENT |
| LOW | crates/metrics/lib/snapshot.rs | 21 | /// Carries both identity (sandbox_id, run_id, pid, name) and the metric | COMMENT |
| LOW | crates/network/lib/network.rs | 141 | COMMENT | |
| LOW | crates/network/lib/udp/relay.rs | 121 | self.payload.len() + self.original_ip_packet.len() | COMMENT |
| LOW | crates/network/lib/udp/relay.rs | 361 | //-------------------------------------------------------------------------------------------------- | COMMENT |
| LOW | crates/network/lib/udp/relay.rs | 381 | /// addressed the gateway. | COMMENT |
| LOW | crates/network/lib/config/types.rs | 21 | /// | COMMENT |
| LOW | crates/network/lib/config/types.rs | 61 | pub tls: TlsConfig, | COMMENT |
| LOW | crates/network/lib/config/types.rs | 81 | #[serde(default)] | COMMENT |
| LOW | crates/network/lib/config/types.rs | 121 | COMMENT | |
| LOW | crates/network/lib/config/builder.rs | 81 | /// ``` | COMMENT |
| LOW | crates/network/lib/config/builder.rs | 321 | /// Whether to ship the host's trusted root CAs into the guest at | COMMENT |
| LOW | crates/network/lib/config/builder.rs | 561 | COMMENT | |
| LOW | crates/network/lib/secrets/handle.rs | 1 | //! Live-swappable view of the active secrets configuration. | COMMENT |
| LOW | crates/network/lib/secrets/handler.rs | 61 | const HTTP2_FLAG_PADDED: u8 = 0x8; | COMMENT |
| LOW | crates/network/lib/secrets/handler.rs | 81 | /// Original guest destination for this connection. | COMMENT |
| LOW | crates/network/lib/secrets/handler.rs | 101 | /// Current HTTP/1 request metadata while processing body continuations. | COMMENT |
| LOW | crates/network/lib/secrets/handler.rs | 4261 | // single HTTP request can arrive as (headers) then (body) in | COMMENT |
| LOW | crates/network/lib/secrets/handler.rs | 4361 | COMMENT | |
| LOW | crates/network/lib/secrets/config.rs | 1 | //! Secret injection configuration types. | COMMENT |
| LOW | crates/network/lib/tls/host_cas.rs | 1 | //! Collect the host's trusted root CAs as a PEM bundle. | COMMENT |
| LOW | crates/network/lib/tls/host_cas.rs | 21 | use std::collections::HashSet; | COMMENT |
| LOW | crates/network/lib/tls/sni.rs | 1 | //! TLS ClientHello SNI extraction. | COMMENT |
| LOW | crates/network/lib/tls/state.rs | 21 | //-------------------------------------------------------------------------------------------------- | COMMENT |
| LOW | crates/network/lib/tls/state.rs | 41 | /// Loaded per connection so live secret updates apply to future traffic. | COMMENT |
| LOW | crates/network/lib/tls/state.rs | 121 | struct NoVerify; | COMMENT |
| LOW | crates/network/lib/tcp/proxy.rs | 921 | // Strip port suffix. | COMMENT |
| LOW | crates/network/lib/tcp/connection.rs | 41 | /// Terminal connection status reported by an outbound proxy task. | COMMENT |
| LOW | crates/network/lib/tcp/connection.rs | 61 | } | COMMENT |
| LOW | crates/network/lib/tcp/connection.rs | 81 | COMMENT | |
| LOW | crates/network/lib/tcp/connection.rs | 101 | /// Proxy-side channel ends, held until the connection is ESTABLISHED. | COMMENT |
| LOW | crates/network/lib/icmp/error.rs | 21 | COMMENT | |
| LOW | crates/network/lib/icmp/relay.rs | 41 | COMMENT | |
| LOW | crates/network/lib/netstack/device.rs | 1 | //! Slot-based [`smoltcp::phy::Device`] implementation. | COMMENT |
| 631 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/network/lib/tcp/proxy.rs | 1499 | // ── extract_http_host ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/network/lib/tcp/proxy.rs | 1549 | // ── plain-HTTP secret substitution ──────────────────────────────────────── | COMMENT |
| MEDIUM | crates/network/lib/netstack/poll.rs | 332 | // ── Phase 1: Drain all guest frames with pre-inspection ────────── | COMMENT |
| MEDIUM | crates/network/lib/netstack/poll.rs | 487 | // ── Phase 2: Ingress egress + maintenance ───────────────────────── | COMMENT |
| MEDIUM | crates/network/lib/netstack/poll.rs | 504 | // ── Phase 3: Service connections + relay data ──────────────────── | COMMENT |
| MEDIUM | crates/network/lib/netstack/poll.rs | 619 | // ── Phase 4: Flush relay data + sleep ──────────────────────────── | COMMENT |
| MEDIUM | crates/network/lib/netstack/poll.rs | 1729 | // ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/network/lib/netstack/poll.rs | 1742 | // ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/image/lib/cache/store.rs | 233 | // ── Layer EROFS paths (keyed by diff_id) ───────────────────────── | COMMENT |
| MEDIUM | crates/image/lib/cache/store.rs | 262 | // ── fsmeta EROFS paths (keyed by manifest digest) ───────────────── | COMMENT |
| MEDIUM | crates/image/lib/cache/store.rs | 286 | // ── VMDK descriptor paths (keyed by manifest digest) ──────────── | COMMENT |
| MEDIUM | crates/image/lib/cache/store.rs | 310 | // ── Flat ext4 artifact paths (manifest ref → content blob) ─────── | COMMENT |
| MEDIUM | crates/image/lib/cache/store.rs | 441 | // ── Staging/tmp paths (downloads, work dirs) ───────────────────── | COMMENT |
| MEDIUM | crates/image/lib/cache/store.rs | 465 | // ── Manifest metadata cache ────────────────────────────────────── | COMMENT |
| MEDIUM | crates/image/lib/cache/store.rs | 583 | // ── Blob cache paths ────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | crates/metrics-collector/lib/lib.rs | 28 | //! ┌─ run loop ─────────────────────────────────────────────┐ | COMMENT |
| MEDIUM⚡ | crates/metrics-collector/lib/lib.rs | 32 | //! └────┬───────────────────────────────────────┬───────────┘ | COMMENT |
| MEDIUM⚡ | crates/metrics-collector/lib/lib.rs | 38 | //! ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ | COMMENT |
| MEDIUM⚡ | crates/metrics-collector/lib/lib.rs | 44 | //! └──────┬──────┘ └──────┬──────┘ └──────┬──────┘ | COMMENT |
| MEDIUM | …s/migration/lib/m20260410_000001_erofs_image_schema.rs | 154 | // ── Drop old tables (FK-safe order) ────────────────────────────── | COMMENT |
| MEDIUM | …s/migration/lib/m20260410_000001_erofs_image_schema.rs | 193 | // ── Create new tables ──────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/config.rs | 1646 | // ── Block Root ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/config.rs | 1755 | // ── File Mounts ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/config.rs | 1804 | // ── Tmpfs ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/config.rs | 1829 | // ── Disk Mounts ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/config.rs | 1951 | // ── Network ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/config.rs | 2046 | // ── Rlimits ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/config.rs | 2092 | // ── Handoff Init ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/network.rs | 227 | // ── ioctl helpers ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/network.rs | 323 | // ── netlink helpers ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/network.rs | 531 | // ── hostname + hosts + resolv.conf ────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/network.rs | 593 | // ── low-level helpers ────────────────────────────────────────────── | COMMENT |
| MEDIUM | crates/agentd/lib/network.rs | 625 | // ── netlink constants and helpers ────────────────────────────────── | COMMENT |
| MEDIUM⚡ | sdk/python/microsandbox/types.py | 12 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | sdk/python/microsandbox/types.py | 14 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | sdk/python/microsandbox/types.py | 19 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | sdk/python/microsandbox/types.py | 21 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 413 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 415 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 531 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 533 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 555 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 557 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 568 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 570 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 617 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 619 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 642 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 644 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 675 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 677 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 838 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 840 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 980 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 982 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 1122 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 1124 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 1210 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 1212 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | sdk/python/microsandbox/types.py | 1731 | # -------------------------------------------------------------------------------------------------- | COMMENT |
| 74 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | sdk/python/integration/test_volumes.py | 69 | "dd if=/dev/zero of=/scratch/small bs=1M count=1 status=none && echo small-ok", | CODE |
| HIGH | sdk/python/integration/test_network.py | 74 | "nc -zv -w 5 1.1.1.1 443 >/dev/null 2>&1 || echo cloudflare-failed; " | CODE |
| HIGH | sdk/python/integration/test_network.py | 75 | "nc -zv -w 5 8.8.8.8 443 >/dev/null 2>&1 || echo google-failed" | CODE |
| HIGH | sdk/python/integration/test_patches.py | 23 | "test -d /opt/py-sdk && cat /opt/py-sdk/config.txt && cat /opt/py-sdk/link.txt" | CODE |
| HIGH⚡ | examples/python/net-secrets/main.py | 28 | "wget -q -O /dev/null --timeout=10 https://example.com && echo OK || echo FAIL" | CODE |
| HIGH⚡ | examples/python/net-secrets/main.py | 28 | "wget -q -O /dev/null --timeout=10 https://example.com && echo OK || echo FAIL" | CODE |
| HIGH⚡ | examples/python/net-secrets/main.py | 36 | "https://cloudflare.com 2>&1 && echo OK || echo BLOCKED" | CODE |
| HIGH⚡ | examples/python/net-secrets/main.py | 36 | "https://cloudflare.com 2>&1 && echo OK || echo BLOCKED" | CODE |
| HIGH | examples/python/net-tls/main.py | 18 | output = await sb.shell("ls /.msb/tls/ca.pem 2>&1 && echo FOUND || echo MISSING") | CODE |
| HIGH | examples/python/net-tls/main.py | 18 | output = await sb.shell("ls /.msb/tls/ca.pem 2>&1 && echo FOUND || echo MISSING") | CODE |
| HIGH⚡ | examples/python/net-tls/main.py | 29 | output = await sb.shell("wget -q -O /dev/null --timeout=5 http://example.com && echo OK || echo FAIL") | CODE |
| HIGH⚡ | examples/python/net-tls/main.py | 29 | output = await sb.shell("wget -q -O /dev/null --timeout=5 http://example.com && echo OK || echo FAIL") | CODE |
| HIGH⚡ | examples/python/net-tls/main.py | 35 | "wget -q -O /dev/null --timeout=10 https://example.com 2>&1 && echo OK || echo FAIL" | CODE |
| HIGH⚡ | examples/python/net-tls/main.py | 35 | "wget -q -O /dev/null --timeout=10 https://example.com 2>&1 && echo OK || echo FAIL" | CODE |
| HIGH⚡ | examples/python/net-tls/main.py | 41 | "wget --no-check-certificate -q -O /dev/null --timeout=10 https://example.com 2>&1 && echo OK || echo FAIL" | CODE |
| HIGH⚡ | examples/python/net-tls/main.py | 41 | "wget --no-check-certificate -q -O /dev/null --timeout=10 https://example.com 2>&1 && echo OK || echo FAIL" | CODE |
| HIGH | examples/python/net-policy/main.py | 17 | output = await sb.shell("wget -q -O /dev/null --timeout=5 http://example.com && echo OK || echo FAIL") | CODE |
| HIGH | examples/python/net-policy/main.py | 17 | output = await sb.shell("wget -q -O /dev/null --timeout=5 http://example.com && echo OK || echo FAIL") | CODE |
| HIGH | examples/python/net-policy/main.py | 30 | output = await sb.shell("wget -q -O /dev/null --timeout=5 http://example.com && echo OK || echo FAIL") | CODE |
| HIGH | examples/python/net-policy/main.py | 30 | output = await sb.shell("wget -q -O /dev/null --timeout=5 http://example.com && echo OK || echo FAIL") | CODE |
| HIGH | examples/python/net-policy/main.py | 43 | output = await sb.shell("wget -q -O /dev/null --timeout=3 http://example.com && echo OK || echo BLOCKED") | CODE |
| HIGH | examples/python/net-policy/main.py | 43 | output = await sb.shell("wget -q -O /dev/null --timeout=3 http://example.com && echo OK || echo BLOCKED") | CODE |
| HIGH⚡ | examples/python/net-dns/main.py | 22 | output = await sb.shell("nslookup example.com 2>&1 | grep -c Address || echo 0") | CODE |
| HIGH⚡ | examples/python/net-dns/main.py | 26 | output = await sb.shell("nslookup blocked.example.com 2>&1 && echo RESOLVED || echo BLOCKED") | CODE |
| HIGH⚡ | examples/python/net-dns/main.py | 26 | output = await sb.shell("nslookup blocked.example.com 2>&1 && echo RESOLVED || echo BLOCKED") | CODE |
| HIGH⚡ | examples/python/net-dns/main.py | 30 | output = await sb.shell("nslookup anything.evil.com 2>&1 && echo RESOLVED || echo BLOCKED") | CODE |
| HIGH⚡ | examples/python/net-dns/main.py | 30 | output = await sb.shell("nslookup anything.evil.com 2>&1 && echo RESOLVED || echo BLOCKED") | CODE |
| HIGH⚡ | examples/python/net-dns/main.py | 34 | output = await sb.shell("nslookup cloudflare.com 2>&1 | grep -c Address || echo 0") | CODE |
| HIGH | examples/python/snapshot-fork/main.py | 16 | await baseline.shell("echo 'shipped via snapshot' > /root/marker.txt && sync") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sdk/python/integration/test_create_kwargs.py | 19 | async def test_create_kwargs_affect_guest_defaults(sandbox_name): | CODE |
| LOW | sdk/python/integration/test_create_kwargs.py | 58 | async def test_create_kwargs_round_trip_through_config_json(sandbox_name): | CODE |
| LOW | sdk/python/integration/test_create_kwargs.py | 158 | async def test_create_kwargs_validate_bad_values( | CODE |
| LOW | sdk/python/integration/test_lifecycle.py | 25 | async def test_create_get_list_connect_stop_start_and_remove(sandbox_name): | CODE |
| LOW | sdk/python/integration/test_lifecycle.py | 126 | async def test_replace_rejects_duplicate_then_replaces(sandbox_name): | CODE |
| LOW | sdk/python/integration/conftest.py | 16 | def _isolate_xdist_worker_home() -> None: | CODE |
| LOW⚡ | sdk/python/integration/test_images.py | 9 | async def test_image_list_returns_cached_handles() -> None: | CODE |
| LOW⚡ | sdk/python/integration/test_images.py | 19 | async def test_image_get_missing_raises_typed_error() -> None: | CODE |
| LOW⚡ | sdk/python/integration/test_images.py | 24 | async def test_image_save_missing_raises_typed_error(tmp_path) -> None: | CODE |
| LOW⚡ | sdk/python/integration/test_images.py | 32 | async def test_image_save_and_load_round_trips_archive(sandbox_factory, tmp_path) -> None: | CODE |
| LOW | sdk/python/integration/test_images.py | 54 | async def test_image_management_round_trips_pulled_sandbox_image(sandbox_factory) -> None: | CODE |
| LOW | sdk/python/integration/test_metrics_logs.py | 39 | async def test_metrics_snapshot_stream_and_all_sandbox_metrics(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_metrics_logs.py | 61 | async def test_logs_snapshot_filters_and_stream_resume(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_volumes.py | 11 | async def test_volume_lifecycle_metadata_and_host_fs(volume_factory): | CODE |
| LOW | sdk/python/integration/test_volumes.py | 38 | async def test_disk_volume_metadata_uses_enums(volume_factory): | CODE |
| LOW | sdk/python/integration/test_volumes.py | 47 | async def test_named_volume_mount_into_sandbox(volume_factory, sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_volumes.py | 62 | async def test_tmpfs_mount_enforces_size_limit(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_exec.py | 14 | async def test_exec_kwargs_and_options_dict(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_exec.py | 63 | async def test_shell_timeout_and_user_env_overrides(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_exec.py | 79 | async def test_exec_stream_iteration_collect_wait_and_signal(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_exec.py | 130 | async def test_exec_stream_tty_resize_while_receiving(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_exec.py | 160 | async def test_exec_stream_missing_binary_surfaces_failure(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_exec.py | 175 | async def test_stdin_modes_and_take_stdin_contract(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_exec.py | 201 | async def test_rlimits_reject_raw_dicts(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_fs.py | 11 | async def test_fs_file_directory_and_metadata_operations(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_fs.py | 47 | async def test_fs_streams_and_host_copy_roundtrip(sandbox_factory, tmp_path): | CODE |
| LOW | sdk/python/integration/test_network.py | 24 | async def test_network_policy_and_port_config_create(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_network.py | 50 | async def test_ip_destination_allows_specific_egress(label, destination, sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_snapshots.py | 20 | async def test_snapshot_create_open_list_and_boot(sandbox_name): | CODE |
| LOW | sdk/python/integration/test_patches.py | 11 | async def test_rootfs_patches_are_applied(sandbox_factory): | CODE |
| LOW | sdk/python/integration/test_pull_progress.py | 14 | async def test_create_with_progress_emits_events_and_returns_sandbox(sandbox_name): | CODE |
| LOW | sdk/python/integration/test_pull_progress.py | 59 | async def test_create_with_progress_result_rejects_on_second_call(sandbox_name): | CODE |
| LOW | sdk/python/integration/test_pull_progress.py | 87 | async def test_create_with_progress_detached_returns_detached_sandbox(sandbox_name): | CODE |
| LOW | sdk/python/integration/test_pull_progress.py | 142 | async def test_create_with_progress_failure_surfaces_from_result(sandbox_name): | CODE |
| LOW⚡ | sdk/python/tests/test_image_source.py | 19 | def test_oci_accepts_root_disk_int() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_image_source.py | 29 | def test_oci_accepts_managed_root_disk() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_image_source.py | 36 | def test_oci_accepts_tmpfs_root_disk() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_image_source.py | 43 | def test_oci_accepts_disk_image_root_disk() -> None: | CODE |
| LOW | sdk/python/tests/test_image_source.py | 58 | def test_oci_accepts_flat_root_disk() -> None: | CODE |
| LOW | sdk/python/tests/test_image_source.py | 73 | def test_oci_accepts_deprecated_upper_size_mib_alias() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_image_source.py | 84 | def test_oci_rejects_root_disk_and_upper_size_mib_together() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_image_source.py | 89 | def test_oci_rejects_raw_root_disk_dict() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_image_source.py | 94 | def test_oci_rejects_bool_root_disk_size() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_image_source.py | 99 | def test_direct_image_source_rejects_bool_root_disk_size() -> None: | CODE |
| LOW | sdk/python/tests/test_image_source.py | 110 | def test_image_namespace_includes_cache_management() -> None: | CODE |
| LOW | sdk/python/tests/test_volume_fs_signature.py | 6 | def test_copy_and_rename_expose_usable_source_keywords() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_mount_policies.py | 81 | def test_bind_owner_omitted_when_unset() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_mount_policies.py | 87 | def test_owner_must_be_paired() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_mount_policies.py | 93 | def test_owner_rejected_on_tmpfs() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_mount_policies.py | 100 | def test_owner_rejects_invalid_python_values(value: object) -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_mount_policies.py | 165 | def test_tmpfs_rejects_stat_virt_at_serialization() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_mount_policies.py | 175 | def test_tmpfs_rejects_host_perms_at_serialization() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_mount_policies.py | 184 | def test_disk_rejects_stat_virt_at_serialization() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_mount_policies.py | 206 | def test_named_mode_uses_canonical_enum_name() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_mount_policies.py | 216 | def test_stat_virtualization_str_values() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_mount_policies.py | 222 | def test_host_permissions_str_values() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_mount_policies.py | 227 | def test_security_profile_str_values() -> None: | CODE |
| LOW⚡ | sdk/python/tests/test_mount_policies.py | 232 | def test_deployment_profile_str_values() -> None: | CODE |
| LOW | sdk/python/tests/test_mount_policies.py | 25 | def test_bind_default_omits_policies() -> None: | CODE |
| LOW | sdk/python/tests/test_mount_policies.py | 33 | def test_bind_rejects_policy_strings() -> None: | CODE |
| 96 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sdk/python/integration/test_create_kwargs.py | 3 | CODE | |
| LOW | sdk/python/integration/test_lifecycle.py | 3 | CODE | |
| LOW | sdk/python/integration/conftest.py | 3 | CODE | |
| LOW | sdk/python/integration/test_images.py | 1 | CODE | |
| LOW | sdk/python/integration/test_metrics_logs.py | 3 | CODE | |
| LOW | sdk/python/integration/test_volumes.py | 3 | CODE | |
| LOW | sdk/python/integration/test_exec.py | 3 | CODE | |
| LOW | sdk/python/integration/test_fs.py | 3 | CODE | |
| LOW | sdk/python/integration/test_network.py | 3 | CODE | |
| LOW | sdk/python/integration/test_snapshots.py | 3 | CODE | |
| LOW | sdk/python/integration/test_patches.py | 3 | CODE | |
| LOW | sdk/python/integration/helpers.py | 3 | CODE | |
| LOW | sdk/python/integration/test_pull_progress.py | 3 | CODE | |
| LOW | sdk/python/tests/test_image_source.py | 3 | CODE | |
| LOW | sdk/python/tests/test_mount_policies.py | 7 | CODE | |
| LOW | sdk/python/tests/test_image_archive.py | 3 | CODE | |
| LOW | sdk/python/tests/test_patch_file.py | 3 | CODE | |
| LOW | sdk/python/tests/test_rate_limiters.py | 3 | CODE | |
| LOW | sdk/python/tests/test_vsock.py | 3 | CODE | |
| LOW | sdk/python/tests/test_types_enums.py | 8 | CODE | |
| LOW | sdk/python/tests/test_modify_stub.py | 3 | CODE | |
| LOW | sdk/python/tests/test_pull_session.py | 3 | CODE | |
| LOW | sdk/python/tests/test_registry_overrides.py | 3 | CODE | |
| LOW | sdk/python/tests/test_secret_passthrough.py | 3 | CODE | |
| LOW | sdk/python/tests/test_network_destinations.py | 3 | CODE | |
| LOW | sdk/python/tests/test_runtime_binary.py | 3 | CODE | |
| LOW | sdk/python/microsandbox/events.py | 3 | CODE | |
| LOW | sdk/python/microsandbox/events.py | 3 | CODE | |
| LOW | sdk/python/microsandbox/events.py | 4 | CODE | |
| LOW | sdk/python/microsandbox/events.py | 4 | CODE | |
| LOW | sdk/python/microsandbox/_cli.py | 8 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| LOW | sdk/python/microsandbox/__init__.py | 5 | CODE | |
| 142 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | crates/network/lib/config/builder.rs | 370 | && (self.config.tls.intercept_ca.cert_path.is_some() | CODE |
| CRITICAL | crates/network/lib/config/builder.rs | 371 | != self.config.tls.intercept_ca.key_path.is_some()) | CODE |
| CRITICAL | sdk/rust/lib/sandbox/mod.rs | 1028 | self.config.spec.runtime.entrypoint.as_deref(), | CODE |
| CRITICAL | sdk/rust/lib/sandbox/mod.rs | 1029 | self.config.spec.runtime.cmd.as_deref(), | CODE |
| CRITICAL | sdk/rust/lib/sandbox/builder.rs | 747 | self.config.spec.network.ports.push(PublishedPortSpec { | CODE |
| CRITICAL | sdk/rust/lib/sandbox/builder.rs | 786 | self.config.spec.vsock.routes.push(VsockRouteSpec { | CODE |
| CRITICAL | sdk/rust/lib/sandbox/builder.rs | 800 | self.config.spec.vsock.routes.push(VsockRouteSpec { | CODE |
| CRITICAL | sdk/rust/lib/sandbox/builder.rs | 810 | self.config.spec.vsock.routes.push(route); | CODE |
| CRITICAL | sdk/rust/lib/sandbox/builder.rs | 1149 | let shell = self.config.spec.runtime.shell.as_deref(); | CODE |
| CRITICAL | sdk/rust/lib/sandbox/builder.rs | 1393 | super::validate_hostname(self.config.spec.runtime.hostname.as_deref())?; | CODE |
| CRITICAL | sdk/rust/lib/sandbox/builder.rs | 1462 | self.config.spec.runtime.entrypoint.as_deref(), | CODE |
| CRITICAL | sdk/rust/lib/sandbox/builder.rs | 1463 | self.config.spec.runtime.cmd.as_deref(), | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/network/lib/policy/name.rs | 266 | "user@example.com", // userinfo@host | CODE |
| LOW | docs/api-reference/openapi.json | 2750 | "placeholder" | CODE |
| LOW | docs/api-reference/openapi.json | 2779 | "placeholder": { | CODE |
| LOW | docs/api-reference/openapi.json | 4740 | "placeholder", | CODE |
| LOW | docs/api-reference/openapi.json | 4760 | "placeholder": { | CODE |
| LOW | sdk/go/modify_test.go | 138 | if apiKey["placeholder"] != "$API_KEY" { | CODE |
| LOW | sdk/go/modify_test.go | 139 | t.Fatalf("placeholder = %v", apiKey["placeholder"]) | CODE |
| LOW | sdk/go/native/src/lib.rs | 7091 | {"name":"API_KEY","source":{"kind":"env","var":"HOST_API_KEY"},"placeholder":"$API_KEY","allowed_hosts": | CODE |
| LOW⚡ | sdk/python/tests/test_modify_stub.py | 52 | assert keys == ["env", "value", "store", "placeholder", "allowed_hosts"] | CODE |
| LOW | sdk/python/microsandbox/types.py | 1169 | d["placeholder"] = self.placeholder | CODE |
| LOW | sdk/python/src/sandbox_handle.rs | 177 | /// `"env"` / `"value"` / `"store"`, plus optional `"placeholder"` and | COMMENT |
| LOW | sdk/python/src/helpers.rs | 1570 | let placeholder: Option<String> = extract_opt(secret, "placeholder")?; | CODE |
| LOW | sdk/python/src/sandbox.rs | 813 | /// `"env"` / `"value"` / `"store"`, plus optional `"placeholder"` and | COMMENT |
| LOW | sdk/python/src/sandbox.rs | 1268 | "placeholder" => placeholder = Some(extract_secret_str(&name, "placeholder", obj)?), | CODE |
| LOW | sdk/python/src/sandbox.rs | 2284 | assert_eq!(secrets[0]["placeholder"], "$API_KEY"); | CODE |
| LOW | sdk/rust/lib/sandbox/modify.rs | 3632 | .is_some_and(|reason| reason.contains("placeholder")) | CODE |
| LOW | packages/microsandbox-types/rust/tests/config_patch.rs | 202 | "placeholder": placeholder | CODE |
| LOW | packages/microsandbox-types/rust/lib/domain.rs | 2299 | .field("placeholder", &self.placeholder) | CODE |
| LOW | packages/microsandbox-types/rust/lib/modify.rs | 407 | .field("placeholder", &self.placeholder) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 421 | > ⏵ **[GSA TTS Agentic Coding Quickstart](https://github.com/GSA-TTS/agentic-coding-quickstart)**<br /> | CODE |
| MEDIUM | README.md | 427 | > ⏵ **[Agentic Usability by PSPDFKit Labs](https://github.com/PSPDFKit-labs/agentic-usability)**<br /> | CODE |
| MEDIUM | packages/agent-client/rust/lib/stream.rs | 1 | //! Generic stream handle scaffold. | COMMENT |
| MEDIUM | packages/agent-client/rust/lib/stream.rs | 53 | /// This scaffold is intentionally not wired to a routing implementation yet. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sdk/python/tests/test_modify_stub.py | 29 | CODE | |
| LOW | sdk/python/microsandbox/types.py | 710 | CODE | |
| LOW | sdk/python/microsandbox/types.py | 999 | CODE | |
| LOW | sdk/python/microsandbox/types.py | 1673 | CODE | |
| LOW | scripts/sync-docs-openapi.py | 154 | CODE | |
| LOW | scripts/sync-docs-openapi.py | 237 | CODE | |
| LOW | scripts/ci/publish-crates.py | 158 | CODE | |
| LOW | scripts/ci/publish-crates.py | 207 | CODE | |
| LOW | scripts/ci/validate_linux_glibc.py | 117 | CODE | |
| LOW | scripts/ci/validate_linux_glibc.py | 153 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/image/lib/registry/client.rs | 384 | // Step 1: Early cache check using persisted image metadata. | COMMENT |
| LOW | crates/image/lib/registry/client.rs | 425 | // Step 2: Resolve manifest. | COMMENT |
| LOW⚡ | crates/image/lib/registry/client.rs | 444 | // Step 3: Parse config. | COMMENT |
| LOW⚡ | crates/image/lib/registry/client.rs | 447 | // Step 4: Get layer descriptors. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | crates/image/lib/registry/client.rs | 384 | // Step 1: Early cache check using persisted image metadata. | COMMENT |
| LOW | crates/image/lib/registry/client.rs | 425 | // Step 2: Resolve manifest. | COMMENT |
| LOW⚡ | crates/image/lib/registry/client.rs | 444 | // Step 3: Parse config. | COMMENT |
| LOW⚡ | crates/image/lib/registry/client.rs | 447 | // Step 4: Get layer descriptors. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | examples/python/volume-named/main.py | 9 | # Create a named volume. | COMMENT |
| MEDIUM | examples/python/fs-read-stream/main.py | 21 | # Create a 10 MiB file with random data inside the sandbox. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sdk/python/integration/conftest.py | 52 | except Exception: | CODE |
| LOW | sdk/python/tests/test_secret_passthrough.py | 69 | except Exception as exc: | CODE |
| LOW | examples/python/lifecycle-convergence/main.py | 27 | except Exception: | CODE |
| LOW | examples/python/lifecycle-convergence/main.py | 201 | except Exception: | CODE |
| LOW | examples/python/net-ports/main.py | 34 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | sdk/rust/Cargo.toml | 20 | # Exposes the archive walker to the fuzz harness (sdk/rust/fuzz). Never enabled in shipping builds. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sdk/python/microsandbox/events.py | 6 | __all__ = ["ExecEvent", "ExecEventType", "PullEvent", "PullEventType"] | CODE |
| LOW | sdk/python/microsandbox/__init__.py | 189 | __all__ = [ | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/bump-version.sh | 5 | # Usage: | COMMENT |