# github.com/grpc-ecosystem/grpc-gateway/v2@v2.30.0 security report (Go)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-05T19:09:08.000Z
- Files reviewed: 362
- Findings: 3 medium, 3 low severity findings
- Report: https://security.togoder.click/go/github.com/grpc-ecosystem/grpc-gateway/v2
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the Go package github.com/grpc-ecosystem/grpc-gateway/v2@v2.30.0 on Oct 5, 2026. An AI review of 362 source files produced 3 medium, 3 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [medium] Insecure transport credentials

Finding ID: `NPS-A58E4AD0C954`

File: `examples/internal/gateway/gateway.go:53`

Both dialTCP and dialUnix use insecure.NewCredentials(), meaning all gRPC traffic is transmitted without TLS. This disables server authentication and encryption, allowing man-in-the-middle interception or tampering. While this is an example package, using insecure credentials in a gateway can be a real risk if copied into production code.

### [medium] Path Traversal

Finding ID: `NPS-7EEFC1D036F1`

File: `examples/internal/gateway/handlers.go:24`

The openAPIServer function takes a path suffix from the URL, trims the '/openapiv2/' prefix, joins it with a base directory, and serves it directly with http.ServeFile. Although path.Join cleans the path, it does not prevent '..' traversal in all cases depending on how it's used, potentially allowing access to files outside the intended directory if the base path is not absolute or if symlinks are involved. The code does not validate that the resolved path stays within the intended directory.

### [medium] Overly Permissive CORS

Finding ID: `NPS-08681360343E`

File: `examples/internal/gateway/handlers.go:34`

The allowCORS middleware reflects the Origin header back in Access-Control-Allow-Origin, allowing any origin. This defeats the same-origin policy and can expose authenticated endpoints to cross-origin attacks if credentials are used. The comments acknowledge this but it remains a security risk in production.

### [low] Insecure transport credentials

Finding ID: `NPS-FC81469CB87A`

File: `examples/internal/gateway/gateway.go:62`

dialUnix also uses insecure.NewCredentials() for unix domain socket connections, omitting TLS on IPC paths that may cross trust boundaries.

### [low] Global package-level channel initialization

Finding ID: `NPS-4C75302480E1`

File: `examples/internal/server/excess_body.go:14`

Package-level variables excessBody_contextChRPC and excessBody_contextChStream are initialized with make(chan context.Context) at package initialization/import time. While not inherently malicious, this is top-level code that runs on import and could be leveraged for goroutine leaks or unintended global state. In this context it appears to be test infrastructure for the grpc-gateway example server.

### [low] Blocking channel send without buffering or receiver guarantee

Finding ID: `NPS-808E5ECDE88C`

File: `examples/internal/server/excess_body.go:32`

Each RPC handler sends ctx or stream.Context() on an unbuffered channel and then blocks on <-ctx.Done(). If no external goroutine calls the RetrieveContext* functions, the handlers will block on the channel send until the context is canceled, potentially causing goroutine leaks or DoS under load. This is a resource-exhaustion concern rather than a data-exfiltration concern; it is consistent with a test harness for verifying context propagation but could be abused if exposed to untrusted clients.

## Files reviewed

- `examples/internal/gateway/gateway.go` (medium): The code is a legitimate grpc-gateway example with no malicious patterns, but it uses insecure gRPC transport credentials that disable TLS.
- `examples/internal/gateway/handlers.go` (medium): The code contains no malicious patterns but includes a potential path traversal in the OpenAPI file server and an overly permissive CORS configuration, both of which pose security risks in a production environment.
- `examples/internal/server/excess_body.go` (medium): This appears to be legitimate grpc-gateway test infrastructure that exposes gRPC contexts via global channels for test verification; the main concerns are unbuffered channel blocking and package-level channel initialization, but no malicious exfiltration, credential harvesting, or command execution patterns are present.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_client.go` (safe): This is a standard go-swagger generated API client with no malicious patterns; authentication helpers accept credentials via parameters and do not harvest or exfiltrate any data.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_check_external_nested_path_enum_parameters.go` (safe): No malicious patterns detected; the file is a standard go-swagger generated client parameter struct with no network exfiltration, credential harvesting, obfuscation, process execution, or install-time behavior.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_check_external_nested_path_enum_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_check_external_path_enum_parameters.go` (safe): No malicious patterns detected in this generated Go Swagger client code; it only defines parameter structs and request-building methods with no network, filesystem, process, or credential access beyond normal HTTP client configuration.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_check_external_path_enum_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_check_get_query_params_parameters.go` (safe): No malicious patterns detected; this is a standard go-swagger generated client parameter file with only benign getter/setter and query-parameter serialization logic.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_check_get_query_params_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_check_nested_enum_get_query_params_parameters.go` (safe): Auto-generated go-swagger client parameter binding code with no malicious patterns, network exfiltration, credential harvesting, or dynamic execution.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_check_nested_enum_get_query_params_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_check_post_query_params_parameters.go` (safe): This is auto-generated go-swagger client code containing only standard parameter setters and request builders with no malicious patterns, external calls, or obfuscation.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_check_post_query_params_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_check_status_parameters.go` (safe): This is a standard go-swagger generated client parameter file with no malicious patterns or suspicious behavior.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_check_status_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_create_body_parameters.go` (safe): No malicious patterns detected; this is standard generated go-swagger client parameter code with no external calls, credential access, or dynamic execution.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_create_body_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_create_book_parameters.go` (safe): No malicious patterns detected
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_create_book_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_create_nested_body_oneof_parameters.go` (safe): No malicious patterns detected
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_create_nested_body_oneof_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_create_parameters.go` (safe): This is auto-generated go-swagger client parameter code with no network exfiltration, credential harvesting, dynamic execution, or other malicious patterns.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_create_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_custom2_parameters.go` (safe): No malicious patterns detected in this auto-generated go-swagger client parameter file.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_custom2_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_custom_options_request_parameters.go` (safe): Auto-generated go-swagger client request parameters file with only standard parameter setters and query/path binding logic; no malicious patterns detected.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_custom_options_request_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_custom_parameters.go` (safe): No malicious patterns detected
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_custom_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_deep_path_echo_parameters.go` (safe): This is standard go-swagger generated client parameter code with no malicious patterns, external network calls, credential harvesting, or dynamic code execution.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_deep_path_echo_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_delete_parameters.go` (safe): This is auto-generated go-swagger client parameter code with no malicious patterns; it only constructs request parameters and timeout/context settings.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_delete_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_double_colon_parameters.go` (safe): No malicious patterns detected; this is standard go-swagger generated client parameter code for an API request.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_double_colon_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_error_with_details_parameters.go` (safe): No malicious patterns detected; this is standard go-swagger generated client parameter code with no network, filesystem, exec, or credential-harvesting behavior.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_error_with_details_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_exists_parameters.go` (safe): This is a go-swagger generated client parameter file with no malicious patterns; it only serializes parameters into HTTP requests using the standard go-openapi runtime.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_exists_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_get_message_with_body_parameters.go` (safe): No malicious patterns detected; this is standard generated go-swagger client parameter code with no exfiltration, obfuscation, shell execution, or suspicious behavior.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_get_message_with_body_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_get_query_parameters.go` (safe): No malicious patterns detected; this is a standard go-swagger generated API client parameter file with no external calls, credential harvesting, obfuscation, or suspicious behavior.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_get_query_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_get_repeated_query_parameters.go` (safe): No malicious patterns detected; this is a standard go-swagger generated client parameter binding file with no network exfiltration, credential harvesting, obfuscation, or process execution code.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_get_repeated_query_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_lookup_parameters.go` (safe): Generated go-swagger client parameter code contains no malicious patterns or security concerns
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_lookup_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_overwrite_request_content_type_parameters.go` (safe): This auto-generated go-swagger API client parameter file contains only standard request parameter construction and serialization logic with no malicious patterns.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_overwrite_request_content_type_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_overwrite_response_content_type_parameters.go` (safe): No malicious patterns detected
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_overwrite_response_content_type_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_post_oneof_enum_parameters.go` (safe): No malicious patterns detected
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_post_oneof_enum_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_post_required_message_type_parameters.go` (safe): No malicious patterns detected; this is generated go-swagger client parameter code with standard request construction and no exfiltration, credential harvesting, or dynamic execution.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_post_required_message_type_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_post_with_empty_body_parameters.go` (safe): This is a standard go-swagger generated client parameter file with no malicious patterns, network calls, credential access, or dynamic code execution.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_post_with_empty_body_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_timeout_parameters.go` (safe): This is a standard go-swagger generated client parameter file with no malicious patterns, performing only normal HTTP request parameter configuration.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_timeout_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_update_book_parameters.go` (safe): No malicious patterns detected; the file is generated go-swagger client parameter code with only standard request construction and no exfiltration, credential access, obfuscation, or process execution.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_update_book_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_update_entity_parameters.go` (safe): No malicious patterns detected; this is a standard go-swagger generated client parameter file with no unsafe operations.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_update_entity_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_update_parameters.go` (safe): This is a standard go-swagger generated client parameter file with no malicious patterns, network exfiltration, credential harvesting, or dynamic code execution.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_update_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_update_v22_parameters.go` (safe): No malicious patterns detected in this auto-generated go-swagger client parameter file.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_update_v22_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_update_v23_parameters.go` (safe): No malicious patterns detected; this is standard go-swagger generated client parameter code for an API request with no network, filesystem, process, or dynamic code execution concerns.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_update_v23_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_update_v2_parameters.go` (safe): No malicious patterns detected in this generated Go Swagger client parameter file; it only contains standard request parameter handling code.
- `examples/internal/clients/abe/client/a_bit_of_everything/a_bit_of_everything_service_update_v2_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/a_bit_of_everything_client.go` (safe): No malicious patterns detected in this auto-generated Go HTTP client code.
- `examples/internal/clients/abe/client/camel_case_service_name/camel_case_service_name_client.go` (safe): This is a standard go-swagger generated API client with no malicious patterns, no obfuscation, no external data harvesting, and no install-time or runtime side effects beyond normal HTTP client functionality.
- `examples/internal/clients/abe/client/camel_case_service_name/camel_case_service_name_empty_parameters.go` (safe): No malicious patterns detected
- `examples/internal/clients/abe/client/camel_case_service_name/camel_case_service_name_empty_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/echo_rpc/a_bit_of_everything_service_echo2_parameters.go` (safe): This is auto-generated go-swagger client parameter code with no malicious patterns, network exfiltration, credential harvesting, or dynamic code execution.
- `examples/internal/clients/abe/client/echo_rpc/a_bit_of_everything_service_echo2_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/echo_rpc/a_bit_of_everything_service_echo3_parameters.go` (safe): No malicious patterns detected
- `examples/internal/clients/abe/client/echo_rpc/a_bit_of_everything_service_echo3_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/echo_rpc/a_bit_of_everything_service_echo_parameters.go` (safe): This is a standard go-swagger generated client parameter file with no malicious patterns, network exfiltration, credential harvesting, or dynamic code execution.
- `examples/internal/clients/abe/client/echo_rpc/a_bit_of_everything_service_echo_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/client/echo_rpc/echo_rpc_client.go` (safe): No malicious patterns detected; this is standard go-swagger generated client code with no data exfiltration, credential harvesting, obfuscation, or process execution.
- `examples/internal/clients/abe/client/snake_enum_service/snake_enum_service_client.go` (safe): No malicious patterns detected; this is standard swagger-generated Go API client code with no exfiltration, credential harvesting, obfuscation, or dynamic execution.
- `examples/internal/clients/abe/client/snake_enum_service/snake_enum_service_snake_enum_parameters.go` (safe): No malicious patterns detected; the file is a standard go-swagger generated client parameter struct with only parameter setters and request writing logic.
- `examples/internal/clients/abe/client/snake_enum_service/snake_enum_service_snake_enum_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/a_bit_of_everything_nested.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/a_bit_of_everything_service_deep_path_echo_body.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/a_bit_of_everything_service_post_with_empty_body_body.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/a_bit_of_everything_service_update_entity_body.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/a_bit_of_everything_service_update_v2_body.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/examplepb_a_bit_of_everything.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/examplepb_a_bit_of_everything_repeated.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/examplepb_a_bit_of_everything_service_update_body.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/examplepb_bar.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/examplepb_body.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/examplepb_book.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/examplepb_check_status_response.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/examplepb_entity_id.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/examplepb_error_object.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/examplepb_error_response.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/examplepb_nested_body_oneof.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/examplepb_numeric_enum.go` (safe): The file contains standard go-swagger generated model code with an init() function that only parses a static enum list and no malicious patterns.
- `examples/internal/clients/abe/models/examplepb_required_message_type_request.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/examplepb_snake_case0_enum.go` (safe): No malicious patterns detected; the file is generated Go model code for enum validation with no network, filesystem, process execution, or credential access.
- `examples/internal/clients/abe/models/examplepb_snake_case_enum.go` (safe): No malicious patterns detected; the file contains standard generated Go enum model code with only local validation and JSON parsing of a hardcoded literal.
- `examples/internal/clients/abe/models/examplepb_snake_enum_response.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/google_rpc_status.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/message_path_enum_nested_path_enum.go` (safe): No malicious patterns detected; the file is generated Swagger model code with only enum validation logic.
- `examples/internal/clients/abe/models/nested_deep_enum.go` (safe): No malicious patterns detected
- `examples/internal/clients/abe/models/oneofenum_example_enum.go` (safe): Code is a standard go-swagger generated enum model with only local validation logic and no malicious patterns.
- `examples/internal/clients/abe/models/pathenum_path_enum.go` (safe): This is a standard go-swagger generated enum model file with no malicious patterns; the init() function only unmarshals a hardcoded static enum array and panics on error, which is benign generated code.
- `examples/internal/clients/abe/models/pathenum_snake_case_for_import.go` (safe): No malicious patterns detected
- `examples/internal/clients/abe/models/proto_examplepb_foo.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/protobuf_any.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/abe/models/sub_string_message.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/client/echo_service/echo_service_client.go` (safe): This is an auto-generated go-swagger API client with standard client constructor, authentication helper functions, and HTTP operation methods; no malicious patterns, exfiltration, credential harvesting, obfuscation, process execution, or dynamic code loading are present.
- `examples/internal/clients/echo/client/echo_service/echo_service_echo2_parameters.go` (safe): This is auto-generated go-swagger client parameter code with no malicious patterns, network requests, credential harvesting, or dynamic execution.
- `examples/internal/clients/echo/client/echo_service/echo_service_echo2_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/client/echo_service/echo_service_echo3_parameters.go` (safe): This is standard auto-generated go-swagger client parameter code with no malicious patterns, dynamic execution, credential harvesting, or suspicious network activity.
- `examples/internal/clients/echo/client/echo_service/echo_service_echo3_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/client/echo_service/echo_service_echo4_parameters.go` (safe): This is a standard go-swagger generated client parameter file with no malicious patterns, external network calls beyond the intended API client, credential harvesting, code execution, or filesystem manipulation.
- `examples/internal/clients/echo/client/echo_service/echo_service_echo4_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/client/echo_service/echo_service_echo5_parameters.go` (safe): No malicious patterns detected
- `examples/internal/clients/echo/client/echo_service/echo_service_echo5_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/client/echo_service/echo_service_echo6_parameters.go` (safe): This is auto-generated go-swagger client parameter code containing only standard parameter setters and request writing logic, with no malicious patterns detected.
- `examples/internal/clients/echo/client/echo_service/echo_service_echo6_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/client/echo_service/echo_service_echo7_parameters.go` (safe): This is a standard go-swagger generated client parameters file with no malicious patterns, network activity, credential harvesting, or dynamic code execution.
- `examples/internal/clients/echo/client/echo_service/echo_service_echo7_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/client/echo_service/echo_service_echo_body2_parameters.go` (safe): No malicious patterns detected; the file is a generated go-swagger API client parameter definition with standard request construction behavior.
- `examples/internal/clients/echo/client/echo_service/echo_service_echo_body2_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/client/echo_service/echo_service_echo_body_parameters.go` (safe): This is standard go-swagger generated client code for building request parameters with no malicious patterns, external network calls, credential harvesting, or dynamic code execution.
- `examples/internal/clients/echo/client/echo_service/echo_service_echo_body_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/client/echo_service/echo_service_echo_delete_parameters.go` (safe): This is auto-generated go-swagger client parameter code with no malicious patterns, no execution at import time, and no network, filesystem, or process manipulation beyond standard HTTP request parameter setting.
- `examples/internal/clients/echo/client/echo_service/echo_service_echo_delete_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/client/echo_service/echo_service_echo_parameters.go` (safe): This is auto-generated go-swagger client code for an echo service with standard parameter handling and no malicious patterns detected
- `examples/internal/clients/echo/client/echo_service/echo_service_echo_patch_parameters.go` (safe): This is auto-generated go-swagger client parameter code with no network exfiltration, credential harvesting, obfuscation, or process spawning; it only builds an HTTP request from caller-supplied parameters.
- `examples/internal/clients/echo/client/echo_service/echo_service_echo_patch_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/client/echo_service/echo_service_echo_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/client/echo_service/echo_service_echo_status_parameters.go` (safe): No malicious patterns detected in the auto-generated Go swagger client parameter file; it performs only standard request parameter handling and context/timeout wiring.
- `examples/internal/clients/echo/client/echo_service/echo_service_echo_status_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/client/echo_service/echo_service_echo_unauthorized_parameters.go` (safe): No malicious patterns detected; this is standard go-swagger generated client code defining parameter structs and request-writing logic.
- `examples/internal/clients/echo/client/echo_service/echo_service_echo_unauthorized_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/client/echo_service_client.go` (safe): Code is a standard go-swagger generated HTTP client for the grpc-gateway echo example with no malicious patterns, no external network calls beyond the configurable API host, no credential harvesting, and no dynamic code execution.
- `examples/internal/clients/echo/models/examplepb_dynamic_message.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/models/examplepb_dynamic_message_update.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/models/examplepb_embedded.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/models/examplepb_nested_message.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/models/examplepb_simple_message.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/models/examplepb_status_check_request.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/models/examplepb_status_check_response.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/models/google_rpc_status.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/models/proto_sub2_status.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/models/proto_sub_status.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/models/protobuf_any.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/echo/models/protobuf_null_value.go` (safe): No malicious patterns detected
- `examples/internal/clients/generateunboundmethods/client/examples_internal_proto_examplepb_generate_unbound_methods_proto_client.go` (safe): No malicious patterns detected
- `examples/internal/clients/generateunboundmethods/client/generate_unbound_methods_echo_service/generate_unbound_methods_echo_service_client.go` (safe): No malicious patterns detected; this is a standard generated go-swagger API client with no data exfiltration, credential harvesting, obfuscation, or install-time execution.
- `examples/internal/clients/generateunboundmethods/client/generate_unbound_methods_echo_service/generate_unbound_methods_echo_service_echo_body_parameters.go` (safe): No malicious patterns detected in this auto-generated go-swagger client parameter file.
- `examples/internal/clients/generateunboundmethods/client/generate_unbound_methods_echo_service/generate_unbound_methods_echo_service_echo_body_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/generateunboundmethods/client/generate_unbound_methods_echo_service/generate_unbound_methods_echo_service_echo_delete_parameters.go` (safe): No malicious patterns detected; this is a standard go-swagger generated client parameter file with no network, filesystem, process, or obfuscation concerns.
- `examples/internal/clients/generateunboundmethods/client/generate_unbound_methods_echo_service/generate_unbound_methods_echo_service_echo_delete_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/generateunboundmethods/client/generate_unbound_methods_echo_service/generate_unbound_methods_echo_service_echo_parameters.go` (safe): This is a go-swagger generated client parameters file with no malicious patterns, external calls, or suspicious activity.
- `examples/internal/clients/generateunboundmethods/client/generate_unbound_methods_echo_service/generate_unbound_methods_echo_service_echo_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/generateunboundmethods/models/examplepb_generate_unbound_methods_simple_message.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/generateunboundmethods/models/protobuf_any.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/generateunboundmethods/models/rpc_status.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/helloworldv3/helloworldv3.go` (safe): No malicious patterns detected in this auto-generated OpenAPI client code, which only contains standard HTTP request construction and JSON serialization logic with no exfiltration, credential harvesting, or dynamic execution.
- `examples/internal/clients/responsebody/client/examples_internal_proto_examplepb_response_body_service_proto_client.go` (safe): No malicious patterns detected; the file is a standard go-swagger generated HTTP client with no execution, data exfiltration, or credential harvesting behavior.
- `examples/internal/clients/responsebody/client/response_body_service/response_body_service_client.go` (safe): No malicious patterns detected; this is a standard go-swagger generated API client with no data exfiltration, credential harvesting, obfuscation, or suspicious execution behavior.
- `examples/internal/clients/responsebody/client/response_body_service/response_body_service_get_response_body_parameters.go` (safe): This is a standard go-swagger generated client parameter file with no malicious patterns, network exfiltration, credential harvesting, or dynamic code execution.
- `examples/internal/clients/responsebody/client/response_body_service/response_body_service_get_response_body_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/responsebody/client/response_body_service/response_body_service_get_response_body_same_name_parameters.go` (safe): No malicious patterns detected in this auto-generated Go client parameter file.
- `examples/internal/clients/responsebody/client/response_body_service/response_body_service_get_response_body_same_name_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/responsebody/client/response_body_service/response_body_service_get_response_body_stream_parameters.go` (safe): This is standard go-swagger generated client parameter code with no malicious patterns, network exfiltration, or credential harvesting.
- `examples/internal/clients/responsebody/client/response_body_service/response_body_service_get_response_body_stream_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/responsebody/client/response_body_service/response_body_service_list_response_bodies_parameters.go` (safe): No malicious patterns detected in this auto-generated go-swagger client parameter file.
- `examples/internal/clients/responsebody/client/response_body_service/response_body_service_list_response_bodies_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/responsebody/client/response_body_service/response_body_service_list_response_strings_parameters.go` (safe): No malicious patterns detected
- `examples/internal/clients/responsebody/client/response_body_service/response_body_service_list_response_strings_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/responsebody/models/examplepb_repeated_response_body_out.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/responsebody/models/examplepb_repeated_response_body_out_response.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/responsebody/models/examplepb_repeated_response_strings.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/responsebody/models/examplepb_response_body_out.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/responsebody/models/examplepb_response_body_out_response.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/responsebody/models/examplepb_response_body_value.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/responsebody/models/google_rpc_status.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/responsebody/models/protobuf_any.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/responsebody/models/response_response_type.go` (safe): No malicious patterns detected; this is a standard go-swagger generated enum model file with only validation logic and a safe init() unmarshal.
- `examples/internal/clients/unannotatedecho/client/unannotated_echo_client.go` (safe): No malicious patterns detected
- `examples/internal/clients/unannotatedecho/client/unannotated_echo_service/unannotated_echo_service_client.go` (safe): This is a standard go-swagger generated API client with no malicious patterns, obfuscation, exfiltration, or install-time execution detected.
- `examples/internal/clients/unannotatedecho/client/unannotated_echo_service/unannotated_echo_service_echo2_parameters.go` (safe): This is an auto-generated go-swagger client parameter file with no malicious patterns; it only constructs HTTP request parameters using standard libraries.
- `examples/internal/clients/unannotatedecho/client/unannotated_echo_service/unannotated_echo_service_echo2_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/unannotatedecho/client/unannotated_echo_service/unannotated_echo_service_echo_body_parameters.go` (safe): This is a standard go-swagger generated client parameter file with no malicious patterns; it only defines request parameter structs and setters.
- `examples/internal/clients/unannotatedecho/client/unannotated_echo_service/unannotated_echo_service_echo_body_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/unannotatedecho/client/unannotated_echo_service/unannotated_echo_service_echo_delete_parameters.go` (safe): No malicious patterns detected; this is a standard go-swagger generated client parameter file.
- `examples/internal/clients/unannotatedecho/client/unannotated_echo_service/unannotated_echo_service_echo_delete_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/unannotatedecho/client/unannotated_echo_service/unannotated_echo_service_echo_nested_parameters.go` (safe): No malicious patterns detected; the file is a standard go-swagger generated client parameter struct with no network, filesystem, process, or dynamic execution behavior.
- `examples/internal/clients/unannotatedecho/client/unannotated_echo_service/unannotated_echo_service_echo_nested_responses.go` (safe): Cleared by Jev triage; no further analysis needed
- `examples/internal/clients/unannotatedecho/client/unannotated_echo_service/unannotated_echo_service_echo_parameters.go` (safe): No malicious patterns detected; this is a standard go-swagger generated client parameter file with no external calls, credential harvesting, obfuscation, or shell/process execution.

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology