eyaltoledano/huginn

API keys, passwords or tokens committed into the repo.

• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  app/models/agents/google_calendar_publish_agent.rb:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  app/models/agents/google_calendar_publish_agent.rb:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious dropbox-api-token Identified a Dropbox API secret, which could lead to unauthorized file access and data breaches in Dropbox storage.
  spec/env.test:8
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  app/models/agents/google_calendar_publish_agent.rb:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  app/models/agents/google_calendar_publish_agent.rb:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious dropbox-api-token Identified a Dropbox API secret, which could lead to unauthorized file access and data breaches in Dropbox storage.
  spec/env.test:8
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  app/models/agents/google_calendar_publish_agent.rb:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  app/models/agents/google_calendar_publish_agent.rb:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious dropbox-api-token Identified a Dropbox API secret, which could lead to unauthorized file access and data breaches in Dropbox storage.
  spec/env.test:8
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  app/models/agents/google_calendar_publish_agent.rb:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  app/models/agents/google_calendar_publish_agent.rb:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious dropbox-api-token Identified a Dropbox API secret, which could lead to unauthorized file access and data breaches in Dropbox storage.
  spec/env.test:8
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  app/models/agents/google_calendar_publish_agent.rb:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  app/models/agents/google_calendar_publish_agent.rb:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious dropbox-api-token Identified a Dropbox API secret, which could lead to unauthorized file access and data breaches in Dropbox storage.
  spec/env.test:8
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  app/models/agents/google_calendar_publish_agent.rb:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  app/models/agents/google_calendar_publish_agent.rb:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious dropbox-api-token Identified a Dropbox API secret, which could lead to unauthorized file access and data breaches in Dropbox storage.
  spec/env.test:8
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  app/models/agents/google_calendar_publish_agent.rb:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  app/models/agents/google_calendar_publish_agent.rb:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious dropbox-api-token Identified a Dropbox API secret, which could lead to unauthorized file access and data breaches in Dropbox storage.
  spec/env.test:8
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  app/models/agents/google_calendar_publish_agent.rb:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  app/models/agents/google_calendar_publish_agent.rb:32
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious dropbox-api-token Identified a Dropbox API secret, which could lead to unauthorized file access and data breaches in Dropbox storage.
  spec/env.test:8
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  .travis.yml:13
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2022-32224 activerecord: Possible RCE escalation bug with Serialized Columns in Active Record
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-32224). Fix: Update that package to its patched version.
• Serious CVE-2022-21831 rubygem-activestorage: Code injection vulnerability in ActiveStorage
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-21831). Fix: Update that package to its patched version.
• Serious CVE-2026-33195 Rails: Active Storage: Active Storage (Rails): Arbitrary file access via path traversal in blob keys
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33195). Fix: Update that package to its patched version.
• Serious CVE-2026-33202 rails: Active Storage: Unintended file deletion via crafted blob keys
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33202). Fix: Update that package to its patched version.
• Serious CVE-2020-8165 rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8165). Fix: Update that package to its patched version.
• Serious CVE-2026-54906 concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: Synchronization flaw in ReadWriteLock allows unauthorized lock release and denial of service
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54906). Fix: Update that package to its patched version.
• Serious CVE-2022-32511 jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a s ...
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-32511). Fix: Update that package to its patched version.
• Serious CVE-2020-14001 rubygem-kramdown: processing template options inside documents allows unintended read access or embedded Ruby code execution
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-14001). Fix: Update that package to its patched version.
• Serious GHSA-353f-x4gh-cqq8 Nokogiri patches vendored libxml2 to resolve multiple CVEs
  Gemfile.lock
  A package you depend on has a known security hole (GHSA-353f-x4gh-cqq8). Fix: Update that package to its patched version.
• Serious CVE-2020-36599 lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before ...
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-36599). Fix: Update that package to its patched version.
• Serious CVE-2022-30123 rubygem-rack: crafted requests can cause shell escape sequences
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-30123). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-8164 rubygem-actionpack: possible strong parameters bypass
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8164). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-22885 rubygem-actionpack: Possible Information Disclosure / Unintended Method Execution in Action Pack
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2021-22885). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-22904 rails: Possible DoS Vulnerability in Action Controller Token Authentication
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2021-22904). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-23633 rubygem-actionpack: information leak between requests
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-23633). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-22792 rubygem-actionpack: Denial of Service in Action Dispatch
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-22792). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-22795 rubygem-actionpack: Denial of Service in Action Dispatch
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-22795). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-8166 rubygem-actionpack: ability to forge per-form CSRF tokens given a global CSRF token
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8166). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-22577 rubygem-actionpack: Possible cross-site scripting vulnerability in Action Pack
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-22577). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-28362 actionpack: Possible XSS via User Supplied Values to redirect_to
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-28362). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-23913 rails: DOM Based Cross-site Scripting in rails-ujs for contenteditable HTML Elements
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-23913). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-15169 rubygem-activeview: Cross-site scripting in translation helpers
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-15169). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-5267 rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-5267). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-8167 rubygem-actionview: CSRF vulnerability in rails-ujs
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8167). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-27777 tfm-rubygem-actionview: Possible cross-site scripting vulnerability in Action View tag helpers
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-27777). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-3hhc-qp5v-9p2j Active Record RCE bug with Serialized Columns
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-32224). Fix: Update that package to its patched version.
• Serious GHSA-r4mg-4433-c7g3 Active Storage allowed transformation methods that were potentially unsafe
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-24293). Fix: Update that package to its patched version.
• Serious GHSA-w749-p3v6-hccq Possible code injection vulnerability in Rails / Active Storage
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-21831). Fix: Update that package to its patched version.
• Serious GHSA-xr9x-r78c-5hrm Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-66066). Fix: Update that package to its patched version.
• Serious GHSA-2p68-f74v-9wc6 ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8165). Fix: Update that package to its patched version.
• Serious GHSA-7xvc-v44j-46fh geokit-rails Command Injection vulnerability
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-26153). Fix: Update that package to its patched version.
• Serious GHSA-5c5f-7vfq-3732 JMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferable
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-32511). Fix: Update that package to its patched version.
• Serious GHSA-mqm2-cgpr-p4m6 Unintended read access in kramdown gem
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-14001). Fix: Update that package to its patched version.
• Serious GHSA-353f-x4gh-cqq8 Nokogiri patches vendored libxml2 to resolve multiple CVEs
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Serious GHSA-pm55-qfxr-h247 OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-36599). Fix: Update that package to its patched version.
• Serious GHSA-wq4h-7r42-5hrr Possible shell escape sequence injection vulnerability in Rack
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-30123). Fix: Update that package to its patched version.
• Worth fixing GHSA-h47h-mwp9-c6q6 Possible ReDoS vulnerability in block_format in Action Mailer
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2024-47889). Fix: Update that package to its patched version.
• Worth fixing GHSA-4g8v-vg43-wpgf Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-28362). Fix: Update that package to its patched version.
• Worth fixing GHSA-7wjx-3g7j-8584 Possible DoS Vulnerability in Action Controller Token Authentication
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2021-22904). Fix: Update that package to its patched version.
• Worth fixing GHSA-8727-m6gj-mc37 Possible Strong Parameters Bypass in ActionPack
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8164). Fix: Update that package to its patched version.
• Worth fixing GHSA-hjg4-8q5f-x6fm Action Pack contains Information Disclosure / Unintended Method Execution vulnerability
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2021-22885). Fix: Update that package to its patched version.
• Worth fixing GHSA-jp5v-5gx4-jmj9 Ability to forge per-form CSRF tokens in Rails
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8166). Fix: Update that package to its patched version.
• Worth fixing GHSA-mm33-5vfq-3mm3 Cross-site Scripting Vulnerability in Action Pack
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-22577). Fix: Update that package to its patched version.
• Worth fixing GHSA-vfg9-r3fq-jvx4 Possible ReDoS vulnerability in HTTP Token authentication in Action Controller
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2024-47887). Fix: Update that package to its patched version.
• Worth fixing GHSA-wh98-p28r-vrc9 Exposure of information in Action Pack
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-23633). Fix: Update that package to its patched version.
• Worth fixing GHSA-x76w-6vjr-8xgj Possible ReDoS vulnerability in query parameter filtering in Action Dispatch
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2024-41128). Fix: Update that package to its patched version.
• Worth fixing GHSA-65cv-r6x7-79hv Cross site scripting vulnerability in ActionView
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-5267). Fix: Update that package to its patched version.
• Worth fixing GHSA-cfjv-5498-mph5 XSS in Action View
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-15169). Fix: Update that package to its patched version.
• Worth fixing GHSA-ch3h-j2vf-95pv XSS Vulnerability in Action View tag helpers
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-27777). Fix: Update that package to its patched version.
• Worth fixing GHSA-xp5h-f8jf-rc8q rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements
  /workdirs/scan-4f184b18-a2cc-49fc-b0ef-b24021993f3b/Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-23913). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0