Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
Nothing found by this check. ✓
Packages you depend on that have known security holes (CVEs).
CVE-2022-1996 go-restful: Authorization Bypass Through User-Controlled KeyCVE-2026-33186 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validationCVE-2022-29718 Open redirect in caddyCVE-2022-23648 containerd: insecure handling of image volumesCVE-2024-25621 github.com/containerd/containerd: containerd local privilege escalationCVE-2020-15257 containerd: unrestricted access to abstract Unix domain socket can lead to privileges escalationCVE-2021-21334 plugin: information leak between containers via environment variablesCVE-2021-32760 containerd: pulling and extracting crafted container image may result in Unix file permission changesCVE-2021-41103 containerd: insufficiently restricted permissions on container root and plugin directoriesCVE-2022-23471 containerd is an open source container runtime. A bug was found in con ...CVE-2022-31030 containerd is an open source container runtime. A bug was found in the ...CVE-2023-25153 containerd: OCI image importer memory exhaustionCVE-2023-25173 containerd: Supplementary groups are not set up properlyCVE-2024-40635 containerd: containerd has an integer overflow in User ID handlingCVE-2025-64329 github.com/containerd/containerd: containerd: Memory exhaustion via CRI Attach implementation goroutine leaksGHSA-7ww5-4wqc-m92c containerd allows RAPL to be accessible to a containerCVE-2021-20206 containernetworking-cni: Arbitrary path injection via type field in CNI configurationGHSA-6xv5-86q9-7xr8 SecureJoin: on windows, paths outside of the rootfs could be inadvertently producedCVE-2023-2253 distribution/distribution: DoS from malicious API requestCVE-2019-13509 docker: Docker Engine in debug mode may sometimes add secrets to the debug log leading to information disclosureCVE-2023-28840 moby: Encrypted overlay network may be unauthenticatedCVE-2026-34040 Moby: Moby: Authorization bypass vulnerabilityCVE-2020-27534 moby/buildkit: calls os.OpenFile with a potentially unsafe qemu-check temporary pathnameCVE-2021-41091 moby: data directory contains subdirectories with insufficiently restricted permissions, which could lead to directory traversalCVE-2022-24769 moby: Default inheritable capabilities for linux container should be emptyYour dependencies cross-checked against the OSV vulnerability database.
GO-2022-0619 Authorization bypass in github.com/emicklei/go-restful, go-restful/v2 and go-restful/v3GO-2026-4762 Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpcGO-2022-0640 Arbitrary Code Execution in github.com/docker/dockerGO-2024-3321 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/cryptoGO-2026-5005 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agentGO-2026-5006 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agentGO-2026-5017 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/sshGO-2026-5019 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/sshGO-2026-5020 Invoking infinite loop on large channel writes in golang.org/x/crypto/sshGO-2026-5021 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhostsGO-2026-5023 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/sshGO-2024-3321 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/cryptoGO-2026-5005 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agentGO-2026-5006 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agentGO-2026-5017 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/sshGO-2026-5019 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/sshGO-2026-5020 Invoking infinite loop on large channel writes in golang.org/x/crypto/sshGO-2026-5021 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhostsGO-2026-5023 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/sshGO-2026-4762 Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpcGO-2022-0230 Improper limitation of path name in github.com/containernetworking/cniGHSA-hqxw-f8mx-cpmw distribution catalog API endpoint can lead to OOM via malicious user inputGO-2022-0390 Moby (Docker Engine) started with non-empty inheritable Linux process capabilities in github.com/docker/dockerGO-2022-0985 Docker supplementary group permissions not set up properly, allowing attackers to bypass primary group restrictions in github.com/docker/dockerGO-2023-1699 Docker Swarm encrypted overlay network may be unauthenticated in github.com/docker/dockerCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.