w3bs.AccountStart building
PACKAGES / Profullstack

r3q

Terminal REST client that stores requests as files you can commit.

ThreatCrush · No malware found
INSTALLw3bs install profullstack.com/r3q

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

  1. w3bs install profullstack.com/r3qInstall r3q and track it for updates
  2. mkdir -p ~/apiCreate a folder to hold your .http request files
  3. r3q ~/apiOpen the REST client TUI on that collection (press n for a new request)

Every option: r3q --help · docs ↗

Malware scan

ThreatCrush found no malware indicators in r3q 0.2.0. The other findings below are ordinary code-review notes, not malware.

Scanned
2026-11-01 22:56 UTC · threatcrush 0.13.30
Files
46 (installer + github.com/profullstack/r3q)
Findings
3 high · 10 medium · 7 low
20 other findings (not malware)
  • high
    Hardcoded Credentialsource/scripts/showcase.ts:45secret-generic-credential · CWE-798
  • high
    outbound request to a non-constant URLsource/src/http/convert.ts:599js-ssrf-outbound-request · CWE-918
  • high
    outbound request to a non-constant URLsource/src/http/protocols.ts:319js-ssrf-outbound-request · CWE-918
  • medium
    regex with nested unbounded quantifierssource/src/http/convert.ts:1064redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/src/http/parse.ts:377redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/src/http/parse.ts:381redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/src/http/query.ts:77redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/src/http/query.ts:212redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/src/http/query.ts:221redos-nested-quantifier · CWE-1333
  • medium
    dynamic code executionsource/src/http/runner.ts:195js-dynamic-code-execution · CWE-95
  • medium
    dynamic code executionsource/src/http/scripts.ts:237js-dynamic-code-execution · CWE-95
  • medium
    dynamic code executionsource/src/http/scripts.ts:296js-dynamic-code-execution · CWE-95
  • medium
    dynamic code executionsource/src/http/variables.ts:213js-dynamic-code-execution · CWE-95
  • low
    Hardcoded Credentialsource/src/http/auth.ts:438secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/http/auth.ts:443secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/http/protocols.ts:652secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/test/auth.test.ts:153secret-generic-credential · CWE-798
  • low
    hardcoded key materialsource/test/auth.test.ts:165js-hardcoded-crypto-key · CWE-321
  • low
    Hardcoded Credentialsource/test/auth.test.ts:228secret-generic-credential · CWE-798
  • low
    Database URL with credentialssource/test/protocols.test.ts:328secret-database-url · CWE-798

Badge for your README

ThreatCrush: No malware found

[![ThreatCrush scan](https://w3bs.org/api/packages/profullstack.com/r3q/badge.svg)](https://w3bs.org/packages/profullstack.com/r3q)