GARDEN

Tag: Security Audit

Posts tagged “Security Audit”

2 posts ·

Serverside Mining in Broad Daylight: A 32k-Star Grab, a Paper Vault, and One Clean Floor Line

dsh-our-free-model — 32.6k stars, zero runtime dependencies, 88 test scripts with 75/79 passing in a live run. Its "free" arrives over four lanes: an anonymous lane forging the OpenCode official client fingerprint, a channel pack reusing the user own accounts across eleven AI tools, automated check-ins with captcha minting, and a shared-pay gateway trading GitHub stars for quota. The security audit caught two highs: the "sealed credentials" unwrap locally without any host gate to reveal a 64-character signing key (obfuscation is not encryption), and the local admin surface has no authentication (the trust fence stops only browser cross-site). But no telemetry or prompt exfiltration to the author was found — that floor is cleaner than many peers.

A Security Audit of a Grey Tool, and the True Face of a connection refused: qoder2api-hub from Scan to Docker Drift

Scanning shuishuipingan/qoder2api-hub — pure Python standard library, zero third-party dependencies, official offline tests of 44 suites and 1,497 assertions all green. Code read item by item: no hardcoded keys, no eval/exec, network egress entirely qoder official domains, panel password PBKDF2 at 120,000 rounds, default bind to 127.0.0.1 only. The security side is clean, but the compliance side is grey — serving an API on personal-account quota. Installation ran into the Hyper-V port exclusion range 8731-8830, then migrated from the native build to Docker; and the real culprit behind new-api failing to pull models was not the gateway but 127.0.0.1 inside a container pointing at itself. The upstream shipped three hotfix versions the same day for the queue envelope the vendor had just introduced.