BudgetScan

Run #4

swesweep-fasthttp · completed

Model
qwen/qwen3.8-27b
Triage model
qwen/qwen3.8-27b
Provider
koscompute
Started
2026-10-17 19:50:32 UTC
Completed
2026-10-18 00:48:07 UTC
Files
78 / 78
  scanned
78
  triage: completed
86
Findings
179
Tokens in / out
4,874,278 / 1,901,214
Cost
$7.75 (estimate:openrouter-list)
Throughput
85.7 tok/s

LLM calls

StageOutcomeCallsTokens inTokens outAvg service sBackoff s
arbiterok52 427,78113,602 6.970.0
contextok78 247,049609,369 145.100.0
scanempty2 14,77624,492 213.5128.3
scanok78 370,599999,097 250.47130.8
scantimeout29 00 600.14220.4
triageok430 3,814,073254,654 13.6973.6
triagetimeout24 00 600.116.2

Findings

SeverityTitleFileTriage
low Unchecked CloseOnExec error can leave listener fd inheritable across exec newSocketCloexecOld tcplisten/socket.go
–
low F_SETFD error can be masked and return a socket without FD_CLOEXEC newSocketCloexec tcplisten/socket_zos_s390x.go
–
low FcntlInt is called on an invalid fd when socket creation fails newSocketCloexec tcplisten/socket_zos_s390x.go
–
low Positive Backlog can be truncated in listen(2) on 64-bit platforms (*Config).fdSetup tcplisten/tcplisten.go
–
low Integer overflow in maxAckBacklog on 32-bit when size is 32 maxAckBacklog tcplisten/tcplisten_linux.go
–
low kernelVersion can overflow or misparse malformed uname.Release kernelVersion tcplisten/tcplisten_linux.go
–
low Unbounded read of /proc/sys/net/core/somaxconn soMaxConn tcplisten/tcplisten_linux.go
–
low Possible TCP Fast Open socket-option misuse enableFastOpen tcplisten/tcplisten_linux.go
–
low Unchecked interface type assertion in AcquireTimer AcquireTimer timer.go
–
low initTimer can panic if a pooled timer is still active initTimer timer.go
–
low AcquireTimer does not validate timeout duration AcquireTimer timer.go
–
low Unvalidated host input allows unbounded certificate material and nonconforming SANs GenerateTestCertificate tls.go
–
low Expensive RSA-2048 key generation on every call is a DoS surface GenerateTestCertificate tls.go
–
low Invalid certificate PEM is returned when x509.CreateCertificate fails GenerateTestCertificate tls.go
–
low Windows backslash dot-segment normalization can produce non-canonical paths normalizePath uri.go
–
low UpdateBytes leaves inconsistent URI state on parse failure updateBytes uri.go
–
low Raw dot segments can be emitted when path normalization is disabled RequestURI uri.go
–
low Setters bypass URI validation used by Parse SetHostBytes/SetPathBytes/SetQueryStringBytes/SetHashBytes uri.go
–
low Host port validation accepts unbounded numeric port length validOptionalPort uri.go
–
low Windows drive-path heuristic can bypass leading-slash normalization addLeadingSlash uri_windows.go
–
low Replacing or clearing a Closer user value without closing it Set() userdata.go
–
low Unbounded user-value storage and linear lookup Set() userdata.go
–
low Unchecked nil WorkerFunc, connState, and Logger callbacks workerFunc workerpool.go
–
low Stop/Start lifecycle leaves mustStop and workersCount stale Start / Stop workerpool.go
–
low Stop does not interrupt busy workers Stop workerpool.go
–
low Data race on stopCh and workerChanPool.New during concurrent lifecycle calls Start / Stop workerpool.go
–
low Missing io.Writer validation can panic with nil or typed-nil writers WriteZstdLevel/WriteUnzstd zstd.go
–
low Zstd encoder write errors are ignored on fast-path compression WriteZstdLevel zstd.go
–
info parseIPv4Octet 'parsed' field can overflow on 32-bit with long leading-zero input parseIPv4Octet bytesconv.go
–
← Previous Page 4 of 4 · 179 total
Arguments
{
  "paths": [
    "/home/ubuntu/sw/swesweep-fasthttp"
  ],
  "files_from": null,
  "re_triage": null,
  "report": null,
  "triage_levels": null,
  "skip_existing": false,
  "model": "qwen/qwen3.8-27b",
  "backend": "koscompute",
  "api_url": null,
  "openrouter_provider": null,
  "parallel": 4,
  "scan_parallel": null,
  "triage_parallel": null,
  "max_connections": null,
  "timeout": 600,
  "thinking": "medium",
  "thinking_scan": null,
  "thinking_triage": null,
  "retries": 20000,
  "max_chars": 350000,
  "extensions": ".go",
  "ignore_dirs": null,
  "skip_tests": true,
  "output_dir": "/home/ubuntu/nano-analyzer-results/swesweep-fasthttp",
  "triage_threshold": "medium",
  "triage_rounds": 5,
  "min_confidence": 0.0,
  "project": null,
  "repo_dir": null,
  "verbose_triage": false,
  "debug_info": null,
  "threat_model": "library",
  "custom_threat_model": null,
  "custom_threat_model_file": null,
  "threat_model_autodetect": true,
  "budget_usd": null,
  "deadline": null,
  "prices_file": null,
  "db": "/home/ubuntu/nano-analyzer-results/swesweep-fasthttp/scan.db",
  "resume": true,
  "summary_sections": {}
}
Threat model
{
  "profile": "library",
  "fingerprint": "00ff1b1a7b11",
  "sources": [
    {
      "kind": "profile",
      "label": "library",
      "chars": 1526,
      "truncated": false
    }
  ],
  "effective": [
    {
      "kind": "profile",
      "label": "library",
      "chars": 1526,
      "truncated": false
    }
  ],
  "warnings": [],
  "contradiction": null,
  "scan_text": "[Profile: library (Reusable library / SDK)]\nAttacker: Code that calls the public API, and above all the data it passes through: parsers, decoders, deserializers and protocol handlers receive adversarial payloads that the host application obtained from untrusted sources.\nEntry points / trust boundary: Public (exported) functions, methods, constructors and callbacks, and every buffer, string, file or stream handed to them. Internal and private helpers are reachable only through the public surface.\nAssets and impact: Memory safety and integrity of the host process (out-of-bounds access, use-after-free, type confusion); correct behaviour on malformed input; resource bounds (unbounded allocation, algorithmic complexity, infinite loops on crafted input); concurrency invariants of components documented as thread-safe.",
  "triage_text": "[Profile: library (Reusable library / SDK)]\nAttacker: Code that calls the public API, and above all the data it passes through: parsers, decoders, deserializers and protocol handlers receive adversarial payloads that the host application obtained from untrusted sources.\nEntry points / trust boundary: Public (exported) functions, methods, constructors and callbacks, and every buffer, string, file or stream handed to them. Internal and private helpers are reachable only through the public surface.\nAssets and impact: Memory safety and integrity of the host process (out-of-bounds access, use-after-free, type confusion); correct behaviour on malformed input; resource bounds (unbounded allocation, algorithmic complexity, infinite loops on crafted input); concurrency invariants of components documented as thread-safe.\nNot a vulnerability under this model: Missing parameter validation in non-public (internal, private, static) functions that are not directly reachable from outside when the public boundary already enforces the invariant; misuse that violates a documented precondition of the public API.\nVerdict rules: Trust invariants: the public API must validate all inputs. Non-public methods may assume invariants verified at the public boundary; do not report missing parameter validation in them as a security vulnerability unless the code is directly reachable from outside or a public path can deliver input that violates the invariant. A crash, memory corruption or unbounded resource use reachable through the public API with a crafted payload is VALID."
}