← Scan another repo

github.com/macrozheng/mall

@ 0504e86b1f1b

Submitted 8/4/2026, 10:25:55 AM · Status: ok

Risk grade
F
100 / 100
Findings
26
0 critical9 high15 medium2 low0 info0 on CISA KEV0ATT&CK
Showing 26 of 26 findings

Findings

  • Detected jwt: Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data
    Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
    gitleaks
  • Detected jwt: Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data
    Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
    gitleaks
  • Hardcoded JSON Web Token (a "eyJ...eyJ...sig" literal). A committed JWT is a live bearer credential until it expires — anyone with repo read access can replay it. Remove it, rotate/revoke the token, a
    Hardcoded JSON Web Token (a "eyJ...eyJ...sig" literal). A committed JWT is a live bearer credential until it expires — anyone with repo read access can replay it. Remove it, rotate/revoke the token, and inject tokens at runtime. (First-party socbox rule; Apache-2.0.)
    semgrepdocument/postman/mall-admin.postman_collection.json:161
  • Hardcoded JSON Web Token (a "eyJ...eyJ...sig" literal). A committed JWT is a live bearer credential until it expires — anyone with repo read access can replay it. Remove it, rotate/revoke the token, a
    Hardcoded JSON Web Token (a "eyJ...eyJ...sig" literal). A committed JWT is a live bearer credential until it expires — anyone with repo read access can replay it. Remove it, rotate/revoke the token, and inject tokens at runtime. (First-party socbox rule; Apache-2.0.)
    semgrepdocument/postman/mall-admin.postman_collection.json:178
  • Hardcoded JSON Web Token (a "eyJ...eyJ...sig" literal). A committed JWT is a live bearer credential until it expires — anyone with repo read access can replay it. Remove it, rotate/revoke the token, a
    Hardcoded JSON Web Token (a "eyJ...eyJ...sig" literal). A committed JWT is a live bearer credential until it expires — anyone with repo read access can replay it. Remove it, rotate/revoke the token, and inject tokens at runtime. (First-party socbox rule; Apache-2.0.)
    semgrepdocument/postman/mall-admin.postman_collection.json:89
  • Hardcoded JSON Web Token (a "eyJ...eyJ...sig" literal). A committed JWT is a live bearer credential until it expires — anyone with repo read access can replay it. Remove it, rotate/revoke the token, a
    Hardcoded JSON Web Token (a "eyJ...eyJ...sig" literal). A committed JWT is a live bearer credential until it expires — anyone with repo read access can replay it. Remove it, rotate/revoke the token, and inject tokens at runtime. (First-party socbox rule; Apache-2.0.)
    semgrepdocument/postman/mall-admin.postman_collection.json:106
  • Hardcoded JSON Web Token (a "eyJ...eyJ...sig" literal). A committed JWT is a live bearer credential until it expires — anyone with repo read access can replay it. Remove it, rotate/revoke the token, a
    Hardcoded JSON Web Token (a "eyJ...eyJ...sig" literal). A committed JWT is a live bearer credential until it expires — anyone with repo read access can replay it. Remove it, rotate/revoke the token, and inject tokens at runtime. (First-party socbox rule; Apache-2.0.)
    semgrepdocument/postman/mall-admin.postman_collection.json:144
  • Deprecated MAINTAINER used
    MAINTAINER has been deprecated since Docker 1.13.0.
    trivydocument/sh/Dockerfile:10
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivydocument/sh/Dockerfile:0
  • Base64 High Entropy String
    Base64 High Entropy String on af28ef0e67cd19f0acd43a14dae68fb8a5d073f2
    checkovmall-admin/src/main/resources/application.yml:21
  • Base64 High Entropy String
    Base64 High Entropy String on 5e25ce007aa95ea2ea8b158aee9c630a32ea5616
    checkovmall-portal/src/main/resources/application.yml:16
  • Base64 High Entropy String
    Base64 High Entropy String on 58bdfee6278a6d46fa72edac8341f82c6d752823
    checkovmall-portal/src/main/resources/application.yml:17
  • Base64 High Entropy String
    Base64 High Entropy String on 5e25ce007aa95ea2ea8b158aee9c630a32ea5616
    checkovmall-admin/src/main/resources/application.yml:20
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /document/sh/Dockerfile.
    checkovdocument/sh/Dockerfile:1
  • Ensure that COPY is used instead of ADD in Dockerfiles
    Ensure that COPY is used instead of ADD in Dockerfiles on /document/sh/Dockerfile.ADD
    checkovdocument/sh/Dockerfile:4
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /document/sh/Dockerfile.
    checkovdocument/sh/Dockerfile:1
  • Ensure that LABEL maintainer is used instead of MAINTAINER (deprecated)
    Ensure that LABEL maintainer is used instead of MAINTAINER (deprecated) on /document/sh/Dockerfile.MAINTAINER
    checkovdocument/sh/Dockerfile:10
  • JSON Web Token
    JSON Web Token on b5fd10b8522a25b9c739afca90853cd15ebaa0a1
    checkovdocument/postman/mall-admin.postman_collection.json:178
  • JSON Web Token
    JSON Web Token on 8805de373198e4c5b705f4b370102dad7dd106c5
    checkovdocument/postman/mall-admin.postman_collection.json:89
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepmall-mbg/src/main/java/com/macro/mall/model/UmsAdmin.java:125
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepmall-mbg/src/main/java/com/macro/mall/model/UmsAdminExample.java:249
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepmall-mbg/src/main/resources/generatorConfig.xml:33
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepmall-mbg/src/main/java/com/macro/mall/model/UmsMemberExample.java:336
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepmall-mbg/src/main/java/com/macro/mall/model/UmsMember.java:226
  • ADD instead of COPY
    You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.
    trivydocument/sh/Dockerfile:4
  • No HEALTHCHECK defined
    You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.
    trivydocument/sh/Dockerfile:0

This report is public.