{"id":31774530,"url":"https://github.com/deadlysurgeon/plainsight","last_synced_at":"2026-07-15T00:37:47.784Z","repository":{"id":315175004,"uuid":"1058380672","full_name":"DeadlySurgeon/plainsight","owner":"DeadlySurgeon","description":"An example of something terrible in plain sight","archived":false,"fork":false,"pushed_at":"2025-09-17T04:22:02.000Z","size":7,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-15T00:37:45.846Z","etag":null,"topics":["golang","proof-of-concept","security","supply-chain-security"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/DeadlySurgeon.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-09-17T02:40:33.000Z","updated_at":"2025-11-19T02:36:04.000Z","dependencies_parsed_at":"2025-11-17T06:00:12.746Z","dependency_job_id":null,"html_url":"https://github.com/DeadlySurgeon/plainsight","commit_stats":null,"previous_names":["deadlysurgeon/plainsight"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/DeadlySurgeon/plainsight","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DeadlySurgeon%2Fplainsight","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DeadlySurgeon%2Fplainsight/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DeadlySurgeon%2Fplainsight/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DeadlySurgeon%2Fplainsight/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/DeadlySurgeon","download_url":"https://codeload.github.com/DeadlySurgeon/plainsight/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/DeadlySurgeon%2Fplainsight/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35485403,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-14T02:00:06.603Z","response_time":114,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["golang","proof-of-concept","security","supply-chain-security"],"created_at":"2025-10-10T04:56:47.365Z","updated_at":"2026-07-15T00:37:47.769Z","avatar_url":"https://github.com/DeadlySurgeon.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Plain Sight\n\nSomething terrible is in (potentially) plain sight. This PoC proves that not all\ncode is as simple as it might seem and expands upon an example snippet I\nproduced that ended up plastering a \"You lost the game!\" banner followed by a\n\"you looked\" gesturing ASCII art hand to the terminal.\n\nWhile the previous iteration was more childish and mundane, this example builds\nupon that to showcase a concern: It is relatively easy to hide such a nasty\nbit of binary, and an attacker with significantly more patience than I have for\nthis example could craft something even more horrifying. This attack vector is\nalso not inherently specific to Go. But something also to point out, even with a\n100% coverage rate for the entire code base, this code actually redirects\nwhatever username and password to an adversary.\n\n```sh\n$ go run main.go --username=bob --password=pass\n```\n\nAlthough the default URL is defined as `http://provider.cluster.local`, running\nthe command above shows that the application actually connects to\n`https://evildomain.lab` which you won't find anywhere in this repository,\nbesides for just now in this very README.md file.\n\n## Coverage Percentage\n\nNot to rant, but while I am here, this repository has **a 100% coverage rate**.\nThis is the exact reason why I think unit tests for the sake of percentage is\nan awful idea. It is so easy to overlook something critically important, and\neven more so you can have a 100% coverage rate while missing significant amounts\nof input. Also, since coverage targeting percentage tends to be more about line\ncoverage than behavior coverage, when it is time to change those lines or add to\nthem you'll find that you'll have to touch the test or maybe even refactor it\nentirely. Thus, by writing unit tests for the sake of Coverage Percentage\ninstead of to a Defined Behavior (fuzzy or not), you end up trading flexibility\nwith a false metric.\n\nIf you or a loved one is pushing this on your project, please seek out\nprofessional help. It is never too late.\n\n```sh\n$ go test ./... --coverprofile coverage.out\nok      github.com/deadlysurgeon/plainsight             0.007s  coverage: 100.0% of statements\nok      github.com/deadlysurgeon/plainsight/auth        0.024s  coverage: 100.0% of statements\n```\n\n## License\n\n```\nCopyright 2024 deadly.surgery\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use these files except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdeadlysurgeon%2Fplainsight","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdeadlysurgeon%2Fplainsight","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdeadlysurgeon%2Fplainsight/lists"}