github.com / we-promise

we-promise/sure

Ruby·7310 files·commit 39e18c7·scanned 4d ago·cached ✓

9/100

SAFE

No malicious patterns found. Repo signals are consistent with a legitimate project.

verdict accurate?

10,663 stars

3% file coverage

CLI tool detected

threat-state: safelive

FINDINGS ░▒▓

warningRust unsafe blockunsafe blocks bypass Rust's memory safety guarantees. Malware uses them for raw pointer manipulation, shellcode injection, or calling dangerous foreign functions.desktop/src-tauri/src/attachments.rs

                match self.ivars().wry.load() {
                    Some(wry) => unsafe {
                        wry.webView_decidePolicyForNavigationAction_decisionHandler(
                         ...

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

infoAuthor has no other public repositoriesGitHub user "github-actions[bot]" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

203 files scanned @ 39e18c7 | 10/25/2026 | heuristic scan — always review manually

risk by category

code execution5

network & exfiltration0

file system access0

obfuscation0

supply chain2

owasp / injection0

telemetry

files 203/7310rules hit 3engine v7commit 39e18c7

github

we-promise/sure

The personal finance app for everyone (by everyone)

Ruby

10663

686

464d

7310 files

203 scanned(3%)

39e18c7

architecture░▒▓

entry (1) flagged (1) pkg (59)

245 nodes · 245 edgesscroll to zoom · click node to jump to finding