cappyzawa/helix

API keys, passwords or tokens committed into the repo.

• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:371
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:385
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:411
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:424
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:439
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:452
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:463
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:478
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:492
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:508
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:520
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:547
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:570
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:624
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:668
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:705
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:742
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:756
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:790
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:831
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:843
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:855
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:909
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:923
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  languages.toml:937
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Worth fixing CVE-2026-40034 gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0 ...
  Cargo.lock
  A package you depend on has a known security hole (CVE-2026-40034). Fix: Update that package to its patched version.
• Worth fixing GHSA-fr8x-3vfx-f45h gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository
  Cargo.lock
  A package you depend on has a known security hole (GHSA-fr8x-3vfx-f45h). Fix: Update that package to its patched version.
• Worth fixing GHSA-p3hw-mv63-rf9w gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure
  Cargo.lock
  A package you depend on has a known security hole (GHSA-p3hw-mv63-rf9w). Fix: Update that package to its patched version.
• Worth fixing GHSA-pg4w-g64p-qwhj gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository
  Cargo.lock
  A package you depend on has a known security hole (GHSA-pg4w-g64p-qwhj). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44471 gitoxide is an implementation of git written in Rust. Prior to 0.21.1, ...
  Cargo.lock
  A package you depend on has a known security hole (CVE-2026-44471). Fix: Update that package to its patched version.
• Worth fixing GHSA-x494-mj8g-cj27 gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data
  Cargo.lock
  A package you depend on has a known security hole (GHSA-x494-mj8g-cj27). Fix: Update that package to its patched version.
• Worth fixing GHSA-9857-6mw7-fq2m gix-transport: HTTP credentials leaked to redirected host in curl backend
  Cargo.lock
  A package you depend on has a known security hole (GHSA-9857-6mw7-fq2m). Fix: Update that package to its patched version.
• Worth fixing GHSA-p3hw-mv63-rf9w gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure
  Cargo.lock
  A package you depend on has a known security hole (GHSA-p3hw-mv63-rf9w). Fix: Update that package to its patched version.
• Worth fixing GHSA-vfvv-c25p-m7mm rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution
  Cargo.lock
  A package you depend on has a known security hole (GHSA-vfvv-c25p-m7mm). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Worth fixing GHSA-f26g-jm89-4g65 gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules
  /workdirs/scan-774a73e9-5a42-43a9-892d-341f4d939fac/Cargo.lock
  A package you depend on has a known security hole (CVE-2026-40034). Fix: Update that package to its patched version.
• Worth fixing GHSA-fr8x-3vfx-f45h gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository
  /workdirs/scan-774a73e9-5a42-43a9-892d-341f4d939fac/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-p3hw-mv63-rf9w gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure
  /workdirs/scan-774a73e9-5a42-43a9-892d-341f4d939fac/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-pg4w-g64p-qwhj gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository
  /workdirs/scan-774a73e9-5a42-43a9-892d-341f4d939fac/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-f89h-2fjh-2r9q gix-fs: Symlink prefix-reuse allows worktree escape during checkout
  /workdirs/scan-774a73e9-5a42-43a9-892d-341f4d939fac/Cargo.lock
  A package you depend on has a known security hole (CVE-2026-44471). Fix: Update that package to its patched version.
• Worth fixing GHSA-x494-mj8g-cj27 gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data
  /workdirs/scan-774a73e9-5a42-43a9-892d-341f4d939fac/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-9857-6mw7-fq2m gix-transport: HTTP credentials leaked to redirected host in curl backend
  /workdirs/scan-774a73e9-5a42-43a9-892d-341f4d939fac/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-p3hw-mv63-rf9w gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure
  /workdirs/scan-774a73e9-5a42-43a9-892d-341f4d939fac/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2026-0122 Potential use-after-free due to lack of panic safety in `InlineVec::clear` and `SerVec::clear`
  /workdirs/scan-774a73e9-5a42-43a9-892d-341f4d939fac/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• FYI RUSTSEC-2026-0190 Unsoundness in `Error::downcast_mut()`
  /workdirs/scan-774a73e9-5a42-43a9-892d-341f4d939fac/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• FYI RUSTSEC-2026-0204 Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
  /workdirs/scan-774a73e9-5a42-43a9-892d-341f4d939fac/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• FYI RUSTSEC-2026-0186 Unchecked pointer offset in crate `memmap2`
  /workdirs/scan-774a73e9-5a42-43a9-892d-341f4d939fac/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• FYI RUSTSEC-2026-0097 Rand is unsound with a custom logger using `rand::rng()`
  /workdirs/scan-774a73e9-5a42-43a9-892d-341f4d939fac/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• FYI RUSTSEC-2026-0001 Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM
  /workdirs/scan-774a73e9-5a42-43a9-892d-341f4d939fac/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• FYI RUSTSEC-2026-0233 Crafted archives can cause a use-after-free during deserialization
  /workdirs/scan-774a73e9-5a42-43a9-892d-341f4d939fac/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• FYI RUSTSEC-2026-0234 Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables
  /workdirs/scan-774a73e9-5a42-43a9-892d-341f4d939fac/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• FYI RUSTSEC-2026-0235 Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc
  /workdirs/scan-774a73e9-5a42-43a9-892d-341f4d939fac/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• FYI RUSTSEC-2026-0249 smartstring is unmaintained
  /workdirs/scan-774a73e9-5a42-43a9-892d-341f4d939fac/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0