BudgetScan

Run #4

swesweep-fasthttp · completed

Model
qwen/qwen3.8-27b
Triage model
qwen/qwen3.8-27b
Provider
koscompute
Started
2026-10-17 19:50:32 UTC
Completed
2026-10-18 00:48:07 UTC
Files
78 / 78
  scanned
78
  triage: completed
86
Findings
179
Tokens in / out
4,874,278 / 1,901,214
Cost
$7.75 (estimate:openrouter-list)
Throughput
85.7 tok/s

LLM calls

StageOutcomeCallsTokens inTokens outAvg service sBackoff s
arbiterok52 427,78113,602 6.970.0
contextok78 247,049609,369 145.100.0
scanempty2 14,77624,492 213.5128.3
scanok78 370,599999,097 250.47130.8
scantimeout29 00 600.14220.4
triageok430 3,814,073254,654 13.6973.6
triagetimeout24 00 600.116.2

Findings

SeverityTitleFileTriage
low Directory index generation enabled by default can leak file names main examples/fileserver/fileserver.go
–
low Unauthenticated /stats endpoint exposes expvar statistics requestHandler examples/fileserver/fileserver.go
–
low Reflected request fields are served without cache and MIME-sniffing hardening requestHandler examples/helloworldserver/helloworldserver.go
–
low Ignored URI parse error main examples/host_client/hostclient.go
–
low Hardcoded credentials sent to local endpoint main examples/host_client/hostclient.go
–
low Missing explicit client timeouts and resource bounds main examples/host_client/hostclient.go
–
low Raw response body printed to stdout main examples/host_client/hostclient.go
–
low Unbounded expvar response generation ExpvarHandler expvarhandler/expvar.go
–
low Raw expvar values inserted into JSON response without validation ExpvarHandler expvarhandler/expvar.go
–
low Hijack after Flush can interleave writes on the same connection writer.Hijack fasthttpadaptor/adaptor.go
–
low Hijack path does not release buffered writer resources writer.Hijack fasthttpadaptor/adaptor.go
–
low Late ResponseWriter writes can race with released pooled buffers writer.Write fasthttpadaptor/adaptor.go
–
low Unvalidated proxy path component injected into socket address addrAndAuth fasthttpproxy/dialer.go
–
low TLS/HTTP proxy selection based on ':443' port suffix heuristic GetDialFunc (slow-path closure) fasthttpproxy/dialer.go
–
low Convenience dialers default to no timeout FasthttpHTTPDialer fasthttpproxy/http.go
–
low Dial creates a client connection with a nil local address Dial fasthttputil/inmemory_listener.go
–
low Caller-supplied net.Addr implementations are trusted and can cause side-effect DoS SetLocalAddr fasthttputil/inmemory_listener.go
–
low Queued attacker data can be read after a read deadline has expired readNextByteBuffer fasthttputil/pipeconns.go
–
low Empty writes can produce Read returns of 0, nil Write, Read fasthttputil/pipeconns.go
–
low Data race on writeDeadlineCh between Write and SetWriteDeadline Write, SetWriteDeadline fasthttputil/pipeconns.go
–
low Mutable unsafe aliasing of string data s2b fasthttputil/s2b.go
–
low Unbounded growth of global filesLockMap sync.Map getFileLock / compressAndOpenFSFile fs.go
–
low VisitHeaderParams passes unvalidated bytes through escape handling VisitHeaderParams header.go
–
low Unbounded trailer accumulation via direct AddTrailerBytes calls AddTrailerBytes header.go
–
low Valid IPv4-embedded IPv6 addresses with '::' immediately before the IPv4 tail are rejected validateIPv6Literal ipv6.go
–
low RemoveClients accepts nil callback and panics without releasing lock LBClient.RemoveClients lbclient.go
–
low Exported field mutation can race with AddClient and Do LBClient.AddClient lbclient.go
–
low Nil serve callback causes child process panic Prefork.ListenAndServe prefork/prefork.go
–
low New(nil) panics due to unchecked fasthttp.Server pointer New prefork/prefork.go
–
low FASTHTTP_PREFORK_CHILD environment variable can force child-mode behavior IsChild prefork/prefork.go
–
low Child listener blindly trusts file descriptor 3 Prefork.listen prefork/prefork.go
–
low File descriptor and listener leaks in prefork setup Prefork.setTCPListenerFiles prefork/prefork.go
–
low RecoverThreshold can allow unbounded child respawn under child-crash conditions Prefork.prefork prefork/prefork.go
–
low Fragile SO_REUSEPORT detection based on error-text substring match Listen reuseport/reuseport.go
–
low Setsockopt errors can be silently discarded listenConfig.Control reuseport/reuseport_aix.go
–
low Setsockopt failures are not propagated from listenConfig.Control listenConfig.Control reuseport/reuseport_solaris.go
–
low Listen does not validate that network is a TCP network Listen reuseport/reuseport_solaris.go
–
low SetsockoptInt error can be silently discarded in the Control callback Control closure in listenConfig.Control, invoked by reuseport.Listen reuseport/reuseport_windows.go
–
low Concurrency slot leak when handler panics in TimeoutWithCodeHandler TimeoutWithCodeHandler server.go
–
low Nil handler in ServeConn causes panic on first request ServeConn (package-level) server.go
–
low Resource leak (br/bw/ctx) on handler panic in serveConn Server.serveConn server.go
–
low No timeout, cancellation, or execution bound for f funcWorker stackless/func.go
–
low Attacker-controlled ctx objects retained by bounded queue NewFunc stackless/func.go
–
low Missing validation of newWriter and returned underlying writer can cause nil interface panics NewWriter stackless/writer.go
–
low Error path can retain pooled output buffer and allow unbounded growth (*writer).do stackless/writer.go
–
low Abandoned reader can leave stream writer blocked indefinitely NewStreamReader stream.go
–
low int64 to int truncation of prefetched buffer size requestStream.Read streaming.go
–
low Unchecked accumulation in totalBytesRead can overflow length accounting requestStream.Read streaming.go
–
low Background DNS cache cleaner goroutine never terminates (goroutine leak) tcpAddrsClean tcpdialer.go
–
low TOCTOU race in getTCPAddrs causes redundant resolution and orphaned cache entries getTCPAddrs tcpdialer.go
–
← Previous Page 3 of 4 · 179 total Next →
Arguments
{
  "paths": [
    "/home/ubuntu/sw/swesweep-fasthttp"
  ],
  "files_from": null,
  "re_triage": null,
  "report": null,
  "triage_levels": null,
  "skip_existing": false,
  "model": "qwen/qwen3.8-27b",
  "backend": "koscompute",
  "api_url": null,
  "openrouter_provider": null,
  "parallel": 4,
  "scan_parallel": null,
  "triage_parallel": null,
  "max_connections": null,
  "timeout": 600,
  "thinking": "medium",
  "thinking_scan": null,
  "thinking_triage": null,
  "retries": 20000,
  "max_chars": 350000,
  "extensions": ".go",
  "ignore_dirs": null,
  "skip_tests": true,
  "output_dir": "/home/ubuntu/nano-analyzer-results/swesweep-fasthttp",
  "triage_threshold": "medium",
  "triage_rounds": 5,
  "min_confidence": 0.0,
  "project": null,
  "repo_dir": null,
  "verbose_triage": false,
  "debug_info": null,
  "threat_model": "library",
  "custom_threat_model": null,
  "custom_threat_model_file": null,
  "threat_model_autodetect": true,
  "budget_usd": null,
  "deadline": null,
  "prices_file": null,
  "db": "/home/ubuntu/nano-analyzer-results/swesweep-fasthttp/scan.db",
  "resume": true,
  "summary_sections": {}
}
Threat model
{
  "profile": "library",
  "fingerprint": "00ff1b1a7b11",
  "sources": [
    {
      "kind": "profile",
      "label": "library",
      "chars": 1526,
      "truncated": false
    }
  ],
  "effective": [
    {
      "kind": "profile",
      "label": "library",
      "chars": 1526,
      "truncated": false
    }
  ],
  "warnings": [],
  "contradiction": null,
  "scan_text": "[Profile: library (Reusable library / SDK)]\nAttacker: Code that calls the public API, and above all the data it passes through: parsers, decoders, deserializers and protocol handlers receive adversarial payloads that the host application obtained from untrusted sources.\nEntry points / trust boundary: Public (exported) functions, methods, constructors and callbacks, and every buffer, string, file or stream handed to them. Internal and private helpers are reachable only through the public surface.\nAssets and impact: Memory safety and integrity of the host process (out-of-bounds access, use-after-free, type confusion); correct behaviour on malformed input; resource bounds (unbounded allocation, algorithmic complexity, infinite loops on crafted input); concurrency invariants of components documented as thread-safe.",
  "triage_text": "[Profile: library (Reusable library / SDK)]\nAttacker: Code that calls the public API, and above all the data it passes through: parsers, decoders, deserializers and protocol handlers receive adversarial payloads that the host application obtained from untrusted sources.\nEntry points / trust boundary: Public (exported) functions, methods, constructors and callbacks, and every buffer, string, file or stream handed to them. Internal and private helpers are reachable only through the public surface.\nAssets and impact: Memory safety and integrity of the host process (out-of-bounds access, use-after-free, type confusion); correct behaviour on malformed input; resource bounds (unbounded allocation, algorithmic complexity, infinite loops on crafted input); concurrency invariants of components documented as thread-safe.\nNot a vulnerability under this model: Missing parameter validation in non-public (internal, private, static) functions that are not directly reachable from outside when the public boundary already enforces the invariant; misuse that violates a documented precondition of the public API.\nVerdict rules: Trust invariants: the public API must validate all inputs. Non-public methods may assume invariants verified at the public boundary; do not report missing parameter validation in them as a security vulnerability unless the code is directly reachable from outside or a public path can deliver input that violates the invariant. A crash, memory corruption or unbounded resource use reachable through the public API with a crafted payload is VALID."
}