coderofphcity/platform

API keys, passwords or tokens committed into the repo.

• Serious curl-auth-header Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.
  docs/api/overview.apib:79
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious curl-auth-header Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.
  docs/api/overview.apib:88
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious curl-auth-header Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.
  docs/api/v5/overview.apib:90
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious curl-auth-header Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.
  docs/api/v5/overview.apib:99
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  docs/api/config.apib:131
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  docs/api/config.apib:132
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  docs/api/config.apib:133
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  docs/api/config.apib:134
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  docs/api/v5/posts.apib:232
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  docs/api/v5/posts.apib:310
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  src/Ushahidi/Modules/V2/ManifestSchemas/Mappings.php:22
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  src/Ushahidi/Modules/V2/ManifestSchemas/Mappings.php:23
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  docs/tech-stack/api-documentation.md:40
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  docs/tech-stack/api-documentation.md:1435
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  docs/tech-stack/api-documentation.md:1483
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  docs/tech-stack/api-documentation.md:1512
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  tests/Integration/v5/webhooks.v5.feature:14
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  tests/Integration/v5/webhooks.v5.feature:34
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  tests/Integration/webhooks.feature:13
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  tests/Integration/webhooks.feature:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  tests/Unit/Core/Tool/VerifierTest.php:24
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  tests/datasets/ushahidi/Base.yml:2003
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2024-51736 CVE-2024-51736: Command execution hijack on Windows with Process class
  composer.lock
  A package you depend on has a known security hole (CVE-2024-51736). Fix: Update that package to its patched version.
• Worth fixing GHSA-27qh-8cxx-2cr5 AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters
  composer.lock
  A package you depend on has a known security hole (GHSA-27qh-8cxx-2cr5). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-14761 Key Commitment Issues in S3 Encryption Clients
  composer.lock
  A package you depend on has a known security hole (CVE-2025-14761). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-69246 Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Gu ...
  composer.lock
  A package you depend on has a known security hole (CVE-2026-69246). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-55568 Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain c ...
  composer.lock
  A package you depend on has a known security hole (CVE-2026-55568). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-55767 Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar in ...
  composer.lock
  A package you depend on has a known security hole (CVE-2026-55767). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-59883 guzzle/guzzle: Guzzle: Cross-host cookie disclosure and injection due to improper domain matching in CookieJar.
  composer.lock
  A package you depend on has a known security hole (CVE-2026-59883). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-67339 guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Prox ...
  composer.lock
  A package you depend on has a known security hole (CVE-2026-67339). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-67353 guzzlehttp/guzzle versions before 7.15.1 contain a denial of service v ...
  composer.lock
  A package you depend on has a known security hole (CVE-2026-67353). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-67354 guzzlehttp/guzzle versions before 7.15.1 contain an information disclo ...
  composer.lock
  A package you depend on has a known security hole (CVE-2026-67354). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-67355 guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only co ...
  composer.lock
  A package you depend on has a known security hole (CVE-2026-67355). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-69245 Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Se ...
  composer.lock
  A package you depend on has a known security hole (CVE-2026-69245). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-48998 guzzlehttp/psr7: guzzlehttp/psr7: Information disclosure via improper Host header validation
  composer.lock
  A package you depend on has a known security hole (CVE-2026-48998). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-49214 guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. ...
  composer.lock
  A package you depend on has a known security hole (CVE-2026-49214). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-55766 guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. ...
  composer.lock
  A package you depend on has a known security hole (CVE-2026-55766). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-59882 guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. ...
  composer.lock
  A package you depend on has a known security hole (CVE-2026-59882). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-29530 HTTP Multiline Header Termination
  composer.lock
  A package you depend on has a known security hole (CVE-2023-29530). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-52301 Laravel is a web application framework. When the register_argc_argv ph ...
  composer.lock
  A package you depend on has a known security hole (CVE-2024-52301). Fix: Update that package to its patched version.
• Worth fixing GHSA-5vg9-5847-vvmq Laravel Framework: CRLF injection in default email rule
  composer.lock
  A package you depend on has a known security hole (GHSA-5vg9-5847-vvmq). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-27515 Laravel is a web application framework. When using wildcard validation ...
  composer.lock
  A package you depend on has a known security hole (CVE-2025-27515). Fix: Update that package to its patched version.
• Worth fixing GHSA-crmm-hgp2-wgrp Laravel Framework: Temporary Signed URL Path Confusion
  composer.lock
  A package you depend on has a known security hole (GHSA-crmm-hgp2-wgrp). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-71488 league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
  composer.lock
  A package you depend on has a known security hole (CVE-2026-71488). Fix: Update that package to its patched version.
• Worth fixing GHSA-c2pc-g5qf-rfrf league/commonmark's quadratic complexity bugs may lead to a denial of service
  composer.lock
  A package you depend on has a known security hole (GHSA-c2pc-g5qf-rfrf). Fix: Update that package to its patched version.
• Worth fixing GHSA-g2gp-3wwq-f4ph league/commonmark: Denial of service via adjacent inline attribute blocks
  composer.lock
  A package you depend on has a known security hole (GHSA-g2gp-3wwq-f4ph). Fix: Update that package to its patched version.
• Worth fixing GHSA-jfm3-95jq-q3rf league/commonmark: Denial of service via duplicate footnote definitions
  composer.lock
  A package you depend on has a known security hole (GHSA-jfm3-95jq-q3rf). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Worth fixing GHSA-27qh-8cxx-2cr5 AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-x8cp-jf6f-r4xh AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2025-14761). Fix: Update that package to its patched version.
• Worth fixing GHSA-2x45-7fc3-mxwq php-jwt contains weak encryption
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2025-45769). Fix: Update that package to its patched version.
• Worth fixing GHSA-94pj-82f3-465w Guzzle: Proxy-Authorization headers can be sent to origin servers
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2026-67339). Fix: Update that package to its patched version.
• Worth fixing GHSA-cwxw-98qj-8qjx guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2026-55767). Fix: Update that package to its patched version.
• Worth fixing GHSA-f283-ghqc-fg79 Guzzle: Unbounded response cookies risk denial of service
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2026-67353). Fix: Update that package to its patched version.
• Worth fixing GHSA-f7vp-7xgx-4w4r Guzzle: Noncanonical cookie domain keeps subdomain scope
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2026-69245). Fix: Update that package to its patched version.
• Worth fixing GHSA-g446-98w2-8p5w Guzzle: Cookie Disclosure and Injection via IP-Address Domains
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2026-59883). Fix: Update that package to its patched version.
• Worth fixing GHSA-h95v-h523-3mw8 Guzzle: URI fragments disclosed in redirect Referer headers
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2026-67354). Fix: Update that package to its patched version.
• Worth fixing GHSA-v5mv-p594-2x33 Guzzle: Noncanonical host can bypass host-based checks
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2026-69246). Fix: Update that package to its patched version.
• Worth fixing GHSA-wm3w-8rrp-j577 Guzzle: Host-only cookie scope is not preserved
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2026-67355). Fix: Update that package to its patched version.
• Worth fixing GHSA-wpwq-4j6v-78m3 guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2026-55568). Fix: Update that package to its patched version.
• Worth fixing GHSA-34xg-wgjx-8xph guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2026-48998). Fix: Update that package to its patched version.
• Worth fixing GHSA-c2w2-prh8-qm98 guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2026-59882). Fix: Update that package to its patched version.
• Worth fixing GHSA-hq7v-mx3g-29hw guzzlehttp/psr7 has CRLF Injection via URI Host Component
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2026-49214). Fix: Update that package to its patched version.
• Worth fixing GHSA-vm85-hxw5-5432 guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2026-55766). Fix: Update that package to its patched version.
• Worth fixing GHSA-xv3h-4844-9h36 HTTP Multiline Header Termination
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2023-29530). Fix: Update that package to its patched version.
• Worth fixing GHSA-5vg9-5847-vvmq Laravel Framework: CRLF injection in default email rule
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-78fx-h6xr-vch4 Laravel has a File Validation Bypass
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2025-27515). Fix: Update that package to its patched version.
• Worth fixing GHSA-crmm-hgp2-wgrp Laravel Framework: Temporary Signed URL Path Confusion
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-gv7v-rgg6-548h Laravel environment manipulation via query string
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2024-52301). Fix: Update that package to its patched version.
• Worth fixing GHSA-29pj-957v-52mc league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2026-71478). Fix: Update that package to its patched version.
• Worth fixing GHSA-2q4p-g7hv-5rgv league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2026-71488). Fix: Update that package to its patched version.
• Worth fixing GHSA-3527-qv2q-pfvx league/commonmark contains a XSS vulnerability in Attributes extension
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2025-46734). Fix: Update that package to its patched version.
• Worth fixing GHSA-4v6x-c7xx-hw9f CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names
  /workdirs/scan-d577dca0-91c4-46c0-9062-3a4da86e9084/composer.lock
  A package you depend on has a known security hole (CVE-2026-30838). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0