Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
Nothing found by this check. ✓
Packages you depend on that have known security holes (CVEs).
CVE-2025-25288 octokit/plugin-paginate-rest: @octokit/plugin-paginate-rest has a Regular Expression in iterator that Leads to ReDoS Vulnerability Due to Catastrophic BacktrackingCVE-2025-25290 octokit/request: @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic BacktrackingCVE-2025-25289 @octokit/request-error: @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic BacktrackingCVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexityCVE-2026-14257 brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() functionCVE-2026-69152 brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arraysCVE-2026-33750 brace-expansion: brace-expansion: Denial of Service via zero step value in brace patternCVE-2026-26996 minimatch: minimatch: Denial of Service via specially crafted glob patternsCVE-2026-27903 minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patternsCVE-2026-27904 minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressionsCVE-2026-41907 uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentialityGHSA-2rxc-gjrp-vjhx Unsoundness in anstreamCVE-2026-25541 Bytes is a utility library for working with bytes. From version 1.2.1 ...GHSA-q6cp-qfwq-4gcv h2 servers vulnerable to degradation of service with CONTINUATION FloodCVE-2024-12224 idna: idna accepts Punycode labels that do not produce any non-ASCII when decodedCVE-2024-27308 CVE-2024-27308 affecting package rpm-ostree for versions less than 2024.4-1CVE-2025-4432 ring: Some AES functions may panic when overflow checking is enabled in ringCVE-2024-32650 Rustls is a modern TLS library written in Rust. `rustls::ConnectionCom ...GHSA-82j2-j2ch-gfr8 rustls-webpki: Denial of service via panic on malformed CRL BIT STRINGCVE-2024-47763 Wasmtime is an open source runtime for WebAssembly. Wasmtime's impleme ...CVE-2026-27204 wasmtime: Wasmtime: Denial of Service via guest-controlled resource exhaustion in WASI host interfacesCVE-2026-27572 wasmtime: Wasmtime: Denial of Service via excessive HTTP header fieldsCVE-2026-34941 wasmtime: Wasmtime: Denial of Service and potential information disclosure via incorrect UTF-16 string validationCVE-2026-34942 wasmtime: Wasmtime: Denial of Service via improper string alignment verificationCVE-2026-34943 Wasmtime: Wasmtime: Denial of Service due to malformed flags-typed component model value processingYour dependencies cross-checked against the OSV vulnerability database.
RUSTSEC-2026-0095 Wasmtime with Winch compiler backend may allow a sandbox-escaping memory accessRUSTSEC-2026-0096 Miscompiled guest heap access enables sandbox escape on aarch64 CraneliftGHSA-h5c3-5r3r-rr8q @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic BacktrackingGHSA-rmvr-2pp2-xj38 @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic BacktrackingGHSA-xx4v-prfh-6cgc @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic BacktrackingGHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsGHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustionGHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashGHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationGHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressionsGHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in patternGHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsGHSA-w5hq-g745-h8pq uuid: Missing buffer bounds check in v3/v5/v6 when buf is providedRUSTSEC-2026-0007 Integer overflow in `BytesMut::reserve`RUSTSEC-2024-0332 Degradation of service in h2 servers with CONTINUATION FloodRUSTSEC-2024-0421 `idna` accepts Punycode labels that do not produce any non-ASCII when decodedRUSTSEC-2024-0019 Tokens for named pipes may be delivered after deregistrationRUSTSEC-2025-0009 Some AES functions may panic when overflow checking is enabled.RUSTSEC-2024-0336 `rustls::ConnectionCommon::complete_io` could fall into an infinite loop based on network inputRUSTSEC-2026-0104 Reachable panic in certificate revocation list parsingRUSTSEC-2026-0020 Guest-controlled resource exhaustion in WASI implementationsRUSTSEC-2026-0021 Panic adding excessive fields to a `wasi:http/types.fields` instanceRUSTSEC-2026-0085 Panic when lifting `flags` component valueRUSTSEC-2026-0087 Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on Cranelift x86-64RUSTSEC-2026-0089 Host panic when Winch compiler executes `table.fill`Code that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.