Run #3

Model: qwen/qwen3.8-27b
Triage model: qwen/qwen3.8-27b
Provider: –
Started: 2026-10-17 19:36:01 UTC
Completed: 2026-10-17 19:50:32 UTC

Files: 0 / 78
triage: completed: 1
triage: in_progress: 1
Findings: 0
Tokens in / out: 0 / 0
Cost: –

LLM calls

Stage	Outcome	Calls	Tokens in	Tokens out	Avg service s
context	ok	3	11,186	34,261	198.61
scan	ok	1	7,723	24,820	479.50
triage	ok	4	23,022	1,760	10.53

Findings

Severity	Title	File	Triage
medium	Unbounded query-string allocation and retained pool capacity Args.ParseBytes	args.go	in_progress
low	Stale key/value slices retained after Reset, ReleaseArgs, and Del Args.Reset	args.go	–
low	Quadratic copy cost when deleting many duplicate query args Args.Del	args.go	–

Arguments

{
  "paths": [
    "/home/ubuntu/sw/swesweep-fasthttp"
  ],
  "files_from": null,
  "re_triage": null,
  "report": null,
  "triage_levels": null,
  "skip_existing": false,
  "model": "qwen/qwen3.8-27b",
  "backend": "koscompute",
  "api_url": null,
  "openrouter_provider": null,
  "parallel": 2,
  "scan_parallel": null,
  "triage_parallel": null,
  "max_connections": null,
  "timeout": 600,
  "thinking": "provider",
  "thinking_scan": null,
  "thinking_triage": null,
  "retries": 20000,
  "max_chars": 350000,
  "extensions": ".go",
  "ignore_dirs": null,
  "skip_tests": true,
  "output_dir": "/home/ubuntu/nano-analyzer-results/swesweep-fasthttp",
  "triage_threshold": "medium",
  "triage_rounds": 5,
  "min_confidence": 0.0,
  "project": null,
  "repo_dir": null,
  "verbose_triage": false,
  "debug_info": null,
  "threat_model": "library",
  "custom_threat_model": null,
  "custom_threat_model_file": null,
  "threat_model_autodetect": true,
  "budget_usd": null,
  "deadline": null,
  "prices_file": null,
  "db": "/home/ubuntu/nano-analyzer-results/swesweep-fasthttp/scan.db",
  "resume": true,
  "summary_sections": {}
}

Threat model

{
  "profile": "library",
  "fingerprint": "00ff1b1a7b11",
  "sources": [
    {
      "kind": "profile",
      "label": "library",
      "chars": 1526,
      "truncated": false
    }
  ],
  "effective": [
    {
      "kind": "profile",
      "label": "library",
      "chars": 1526,
      "truncated": false
    }
  ],
  "warnings": [],
  "contradiction": null,
  "scan_text": "[Profile: library (Reusable library / SDK)]\nAttacker: Code that calls the public API, and above all the data it passes through: parsers, decoders, deserializers and protocol handlers receive adversarial payloads that the host application obtained from untrusted sources.\nEntry points / trust boundary: Public (exported) functions, methods, constructors and callbacks, and every buffer, string, file or stream handed to them. Internal and private helpers are reachable only through the public surface.\nAssets and impact: Memory safety and integrity of the host process (out-of-bounds access, use-after-free, type confusion); correct behaviour on malformed input; resource bounds (unbounded allocation, algorithmic complexity, infinite loops on crafted input); concurrency invariants of components documented as thread-safe.",
  "triage_text": "[Profile: library (Reusable library / SDK)]\nAttacker: Code that calls the public API, and above all the data it passes through: parsers, decoders, deserializers and protocol handlers receive adversarial payloads that the host application obtained from untrusted sources.\nEntry points / trust boundary: Public (exported) functions, methods, constructors and callbacks, and every buffer, string, file or stream handed to them. Internal and private helpers are reachable only through the public surface.\nAssets and impact: Memory safety and integrity of the host process (out-of-bounds access, use-after-free, type confusion); correct behaviour on malformed input; resource bounds (unbounded allocation, algorithmic complexity, infinite loops on crafted input); concurrency invariants of components documented as thread-safe.\nNot a vulnerability under this model: Missing parameter validation in non-public (internal, private, static) functions that are not directly reachable from outside when the public boundary already enforces the invariant; misuse that violates a documented precondition of the public API.\nVerdict rules: Trust invariants: the public API must validate all inputs. Non-public methods may assume invariants verified at the public boundary; do not report missing parameter validation in them as a security vulnerability unless the code is directly reachable from outside or a public path can deliver input that violates the invariant. A crash, memory corruption or unbounded resource use reachable through the public API with a crafted payload is VALID."
}