angristan/remark42

API keys, passwords or tokens committed into the repo.

• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  backend/app/cmd/testdata/key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  backend/app/rest/api/rest_test.go:41
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  backend/app/rest/api/rest_test.go:43
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  backend/app/rest/api/rest_test.go:45
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  backend/app/rest/api/rest_test.go:47
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  backend/remark.rest:10
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  backend/remark.rest:61
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  backend/remark.rest:123
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  backend/remark.rest:127
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  backend/remark.rest:131
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  backend/remark.rest:135
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  backend/remark.rest:142
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  backend/remark.rest:145
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  backend/remark.rest:146
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  backend/remark.rest:155
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  frontend/app/__stubs__/jwt.ts:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  README.md:252
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  README.md:418
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  docs/latest/email.md:81
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  docs/latest/email.md:98
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  docs/latest/email.md:134
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  docs/1.6/email.md:81
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  docs/1.6/email.md:98
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  docs/1.6/email.md:134
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2026-33186 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2026-33186). Fix: Update that package to its patched version.
• Serious CVE-2026-33186 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
  backend/go.mod
  A package you depend on has a known security hole (CVE-2026-33186). Fix: Update that package to its patched version.
• Serious CVE-2026-33186 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
  backend/vendor/github.com/go-pkgz/auth/go.mod
  A package you depend on has a known security hole (CVE-2026-33186). Fix: Update that package to its patched version.
• Serious CVE-2026-33186 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
  backend/vendor/golang.org/x/oauth2/go.mod
  A package you depend on has a known security hole (CVE-2026-33186). Fix: Update that package to its patched version.
• Worth fixing GHSA-vrw8-fxc6-2r93 chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (GHSA-vrw8-fxc6-2r93). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-45339 github.com/golang/glog: Vulnerability when creating log files in github.com/golang/glog
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2024-45339). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-42576 The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Py ...
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2021-42576). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-65637 github.com/sirupsen/logrus: github.com/sirupsen/logrus: Denial-of-Service due to large single-line payload
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2025-65637). Fix: Update that package to its patched version.
• Worth fixing GHSA-gxhx-2686-5h9g slack-go `SecretsVerifier` accepts empty signing secret without precondition
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (GHSA-gxhx-2686-5h9g). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-35380 GJSON before 1.6.4 allows attackers to cause a denial of service via c ...
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2020-35380). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-36066 GJSON <1.6.5 allows attackers to cause a denial of service (remote) vi ...
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2020-36066). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-36067 GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: r ...
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2020-36067). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-42836 GJSON before 1.9.3 allows a ReDoS (regular expression denial of servic ...
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2021-42836). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-21221 Path traversal in github.com/valyala/fasthttp
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2022-21221). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-2303 CVE-2026-2303 affecting package telegraf for versions less than 1.29.4-21
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2026-2303). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-43565 golang.org/x/crypto: empty plaintext packet causes panic
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2021-43565). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-27191 golang: crash in a golang.org/x/crypto/ssh server
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2022-27191). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-45337 golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2024-45337). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-22869 golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2025-22869). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-47913 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2025-47913). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39828 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2026-39828). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39829 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2026-39829). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39830 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2026-39830). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39831 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2026-39831). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39832 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
  backend/_example/memory_store/go.mod
  A package you depend on has a known security hole (CVE-2026-39832). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GO-2022-0588 Cross-site scripting via leaked style elements in github.com/microcosm-cc/bluemonday
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/_example/memory_store/go.sum
  A package you depend on has a known security hole (CVE-2021-42576). Fix: Update that package to its patched version.
• Serious GO-2022-0588 Cross-site scripting via leaked style elements in github.com/microcosm-cc/bluemonday
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/go.mod
  A package you depend on has a known security hole (CVE-2021-42576). Fix: Update that package to its patched version.
• Serious GO-2024-3321 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/go.mod
  A package you depend on has a known security hole (CVE-2024-45337). Fix: Update that package to its patched version.
• Serious GO-2026-5005 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/go.mod
  A package you depend on has a known security hole (CVE-2026-39833). Fix: Update that package to its patched version.
• Serious GO-2026-5006 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/go.mod
  A package you depend on has a known security hole (CVE-2026-39832). Fix: Update that package to its patched version.
• Serious GO-2026-5017 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/go.mod
  A package you depend on has a known security hole (CVE-2026-39830). Fix: Update that package to its patched version.
• Serious GO-2026-5019 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/go.mod
  A package you depend on has a known security hole (CVE-2026-39831). Fix: Update that package to its patched version.
• Serious GO-2026-5020 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/go.mod
  A package you depend on has a known security hole (CVE-2026-39834). Fix: Update that package to its patched version.
• Serious GO-2026-5021 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/go.mod
  A package you depend on has a known security hole (CVE-2026-42508). Fix: Update that package to its patched version.
• Serious GO-2026-5023 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/go.mod
  A package you depend on has a known security hole (CVE-2026-46595). Fix: Update that package to its patched version.
• Serious GO-2022-0588 Cross-site scripting via leaked style elements in github.com/microcosm-cc/bluemonday
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/vendor/github.com/go-pkgz/auth/go.mod
  A package you depend on has a known security hole (CVE-2021-42576). Fix: Update that package to its patched version.
• Serious GO-2024-3321 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/vendor/github.com/go-pkgz/auth/go.sum
  A package you depend on has a known security hole (CVE-2024-45337). Fix: Update that package to its patched version.
• Serious GO-2026-5005 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/vendor/github.com/go-pkgz/auth/go.sum
  A package you depend on has a known security hole (CVE-2026-39833). Fix: Update that package to its patched version.
• Serious GO-2026-5006 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/vendor/github.com/go-pkgz/auth/go.sum
  A package you depend on has a known security hole (CVE-2026-39832). Fix: Update that package to its patched version.
• Serious GO-2026-5017 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/vendor/github.com/go-pkgz/auth/go.sum
  A package you depend on has a known security hole (CVE-2026-39830). Fix: Update that package to its patched version.
• Serious GO-2026-5019 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/vendor/github.com/go-pkgz/auth/go.sum
  A package you depend on has a known security hole (CVE-2026-39831). Fix: Update that package to its patched version.
• Serious GO-2026-5020 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/vendor/github.com/go-pkgz/auth/go.sum
  A package you depend on has a known security hole (CVE-2026-39834). Fix: Update that package to its patched version.
• Serious GO-2026-5021 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/vendor/github.com/go-pkgz/auth/go.sum
  A package you depend on has a known security hole (CVE-2026-42508). Fix: Update that package to its patched version.
• Serious GO-2026-5023 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/vendor/github.com/go-pkgz/auth/go.sum
  A package you depend on has a known security hole (CVE-2026-46595). Fix: Update that package to its patched version.
• Worth fixing GO-2023-1572 Denial of service via crafted TIFF image in golang.org/x/image/tiff
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/_example/memory_store/go.sum
  A package you depend on has a known security hole (CVE-2022-41727). Fix: Update that package to its patched version.
• Worth fixing GO-2023-1989 Excessive resource consumption in golang.org/x/image/tiff
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/_example/memory_store/go.sum
  A package you depend on has a known security hole (CVE-2023-29408). Fix: Update that package to its patched version.
• Worth fixing GO-2023-1990 Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/_example/memory_store/go.sum
  A package you depend on has a known security hole (CVE-2023-29407). Fix: Update that package to its patched version.
• Worth fixing GO-2024-2937 Panic when parsing invalid palette-color images in golang.org/x/image
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/_example/memory_store/go.sum
  A package you depend on has a known security hole (CVE-2024-24792). Fix: Update that package to its patched version.
• Worth fixing GO-2026-4815 OOM from malicious IFD offset in golang.org/x/image/tiff
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/_example/memory_store/go.sum
  A package you depend on has a known security hole (CVE-2026-33809). Fix: Update that package to its patched version.
• Worth fixing GO-2026-5032 Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff
  /workdirs/scan-0da13eef-75d3-4cf4-9b7d-050ed8c341ed/backend/_example/memory_store/go.sum
  A package you depend on has a known security hole (CVE-2026-46599). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0