a public repository, read by nittim
Is AlistGo/alist production ready?
What nittim read in this repository, and what it found. Public repository, public reading — sourced from its own code and dependency manifests, nothing else.
🗂️A file list/WebDAV program that supports multiple storages, powered by Gin and Solidjs. / 一个支持多存储的文件列表/WebDAV程序，使用 Gin 和 Solidjs。
Go · 50.3k stars · last push October 13, 2026
AlistGo/alist is a file list and WebDAV program written in Go that supports multiple storage backends. It uses the Gin web framework and Solidjs for its interface to provide a flexible solution for managing files across different storage systems.
Nittim scanned 851 files in AlistGo/alist and found evidence of issues. The scan detected 12 committed credentials on production paths and 10 vulnerable runtime dependencies. Seven packages contain known vulnerabilities: github.com/fatedier/frp with GHSA-26gq-p25f-99cp, github.com/rclone/rclone with GHSA-25qr-6mpr-f7qx and GHSA-2m8m-jhrm-w6j2, go.opentelemetry.io/otel with GHSA-mh2q-q3fh-2475, go.opentelemetry.io/otel/sdk with GHSA-9h8m-3fm2-qjrq and GHSA-hfvc-g4fc-pqhx, golang.org/x/crypto with GHSA-5cgq-3rg8-m6cv, golang.org/x/image with GHSA-q675-qj96-32m9, and google.golang.org/grpc with GHSA-2v4p-qf9q-27wj and GHSA-hrxh-6v49-42gf.
Developers should update the vulnerable dependencies to patched versions and remove the committed credentials from the repository history. After making these changes, rescan the repository to confirm the issues are resolved. Running a full audit will provide detailed remediation guidance for each vulnerability.
Written from nittim's own scan on October 15, 2026; rescanned when the repository changes.
No verdict. The rule-based check reports hard evidence, or reports that it found none. Neither is a judgment on whether this code is safe to ship.
What was read — rule-based scan
Rule-based checks run on nittim's servers — a secret scanner and a dependency check, no model in the path. The code reached those two and stopped there.
Read 851 of 851 eligible files. Commit ea628f9. 2026-10-15.
What the scanners found
- Committed secrets on production paths
- 12
- Vulnerable runtime dependencies
- 10
github.com/fatedier/frp (GHSA-26gq-p25f-99cp), github.com/rclone/rclone (GHSA-25qr-6mpr-f7qx, GHSA-2m8m-jhrm-w6j2), go.opentelemetry.io/otel (GHSA-mh2q-q3fh-2475), go.opentelemetry.io/otel/sdk (GHSA-9h8m-3fm2-qjrq, GHSA-hfvc-g4fc-pqhx), golang.org/x/crypto (GHSA-5cgq-3rg8-m6cv), golang.org/x/image (GHSA-q675-qj96-32m9), google.golang.org/grpc (GHSA-2v4p-qf9q-27wj, GHSA-hrxh-6v49-42gf)
Run it yourself
Scan any public repository in seconds — no sign-in, no card. Audit it to have a model read the code. Loop the report into your assistant to get the fixes applied and re-checked.
Scan your own repoQuestions
- What did nittim read in AlistGo/alist?
- nittim read 851 of 851 eligible files in AlistGo/alist. The reading ran on October 15, 2026. It was taken at commit ea628f9.
- Did nittim find committed secrets or vulnerable dependencies in AlistGo/alist?
- The rule-based scan found 12 committed secrets and 10 vulnerable dependencies in AlistGo/alist. Affected: github.com/fatedier/frp (GHSA-26gq-p25f-99cp), github.com/rclone/rclone (GHSA-25qr-6mpr-f7qx, GHSA-2m8m-jhrm-w6j2), go.opentelemetry.io/otel (GHSA-mh2q-q3fh-2475), go.opentelemetry.io/otel/sdk (GHSA-9h8m-3fm2-qjrq, GHSA-hfvc-g4fc-pqhx), golang.org/x/crypto (GHSA-5cgq-3rg8-m6cv), golang.org/x/image (GHSA-q675-qj96-32m9), google.golang.org/grpc (GHSA-2v4p-qf9q-27wj, GHSA-hrxh-6v49-42gf).
- Is AlistGo/alist production ready?
- A free scan is not a verdict. A full audit gives one.
More like this
Add the badge to your README
[](https://nittim.com/library/AlistGo/alist)