github.com/felixrieseberg/claude-coach ↗

felixrieseberg/claude-coach

scanned 2026-08-12 · git d9551c7

2 of 6 checks flagged a security issue

🔴 Needs attention

Only 3 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets—Vulnerable dependencies16Known OSS vulnerabilities49Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 400s

Vulnerable dependencies — Trivyⓘ 16 found

Packages you depend on that have known security holes (CVEs).

Worth fixing CVE-2026-12151 undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames

package-lock.json

A package you depend on has a known security hole (CVE-2026-12151). Fix: Update that package to its patched version.
Worth fixing CVE-2026-13697 undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives

package-lock.json

A package you depend on has a known security hole (CVE-2026-13697). Fix: Update that package to its patched version.
Worth fixing CVE-2026-1526 undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression

package-lock.json

A package you depend on has a known security hole (CVE-2026-1526). Fix: Update that package to its patched version.
Worth fixing CVE-2026-1528 undici: undici: Denial of Service via crafted WebSocket frame with large length

package-lock.json

A package you depend on has a known security hole (CVE-2026-1528). Fix: Update that package to its patched version.
Worth fixing CVE-2026-2229 undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter

package-lock.json

A package you depend on has a known security hole (CVE-2026-2229). Fix: Update that package to its patched version.
Worth fixing CVE-2026-14643 undici: undici: Cross-user information disclosure due to improper Cache-Control directive parsing

package-lock.json

A package you depend on has a known security hole (CVE-2026-14643). Fix: Update that package to its patched version.
Worth fixing CVE-2026-15157 undici: undici: HTTP header injection via unvalidated blob-like body type property

package-lock.json

A package you depend on has a known security hole (CVE-2026-15157). Fix: Update that package to its patched version.
Worth fixing CVE-2026-1525 undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers

package-lock.json

A package you depend on has a known security hole (CVE-2026-1525). Fix: Update that package to its patched version.
Worth fixing CVE-2026-1527 undici: Undici: HTTP header injection and request smuggling vulnerability

package-lock.json

A package you depend on has a known security hole (CVE-2026-1527). Fix: Update that package to its patched version.
Worth fixing CVE-2026-16728 undici: undici: Response desynchronization via retry interceptor with mismatched Content-Length

package-lock.json

A package you depend on has a known security hole (CVE-2026-16728). Fix: Update that package to its patched version.
Worth fixing CVE-2026-16729 undici: Undici: Cookie attribute injection allows bypassing security protections

package-lock.json

A package you depend on has a known security hole (CVE-2026-16729). Fix: Update that package to its patched version.
Worth fixing CVE-2026-22036 undici: Undici: Denial of Service via excessive decompression steps

package-lock.json

A package you depend on has a known security hole (CVE-2026-22036). Fix: Update that package to its patched version.
Worth fixing CVE-2026-9678 undici: Undici: Information disclosure due to improper cache-control header parsing

package-lock.json

A package you depend on has a known security hole (CVE-2026-9678). Fix: Update that package to its patched version.
Worth fixing CVE-2026-9679 undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

package-lock.json

A package you depend on has a known security hole (CVE-2026-9679). Fix: Update that package to its patched version.
Minor CVE-2026-11525 undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header

package-lock.json

A package you depend on has a known security hole (CVE-2026-11525). Fix: Update that package to its patched version.
Minor CVE-2026-6733 undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery.

package-lock.json

A package you depend on has a known security hole (CVE-2026-6733). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 49 found · 1 serious

Your dependencies cross-checked against the OSV vulnerability database.

Serious GHSA-5xrq-8626-4rwp When Vitest UI server is listening, arbitrary file can be read and executed

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-47429). Fix: Update that package to its patched version.
Worth fixing GHSA-cfw5-2vxh-hr84 devalue has prototype pollution in devalue.parse and devalue.unflatten

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-30226). Fix: Update that package to its patched version.
Worth fixing GHSA-g2pg-6438-jwpf devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-22775). Fix: Update that package to its patched version.
Worth fixing GHSA-vw5p-8cq8-m7mv Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-22774). Fix: Update that package to its patched version.
Worth fixing GHSA-28wg-ghj8-5hjv nanoid: non-secure generators can loop indefinitely with negative size

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-67214). Fix: Update that package to its patched version.
Worth fixing GHSA-2v37-7h3g-55p8 nanoid: custom generators can loop indefinitely when size is zero

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-67213). Fix: Update that package to its patched version.
Worth fixing GHSA-3v7f-55p6-f55p Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-33672). Fix: Update that package to its patched version.
Worth fixing GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-33671). Fix: Update that package to its patched version.
Worth fixing GHSA-3v7f-55p6-f55p Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-33672). Fix: Update that package to its patched version.
Worth fixing GHSA-c2c7-rcm5-vvqj Picomatch has a ReDoS vulnerability via extglob quantifiers

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-33671). Fix: Update that package to its patched version.
Worth fixing GHSA-6g55-p6wh-862q PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-45623). Fix: Update that package to its patched version.
Worth fixing GHSA-fxqj-rqcc-2cmp PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-69153). Fix: Update that package to its patched version.
Worth fixing GHSA-qx2v-qp2m-jg93 PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-41305). Fix: Update that package to its patched version.
Worth fixing GHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-mw96-cpmx-2vgc Rollup 4 has Arbitrary File Write via Path Traversal

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-27606). Fix: Update that package to its patched version.
Worth fixing GHSA-6738-r8g5-qwp3 svelte vulnerable to Cross-site Scripting

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2025-15265). Fix: Update that package to its patched version.
Worth fixing GHSA-crpf-4hrx-3jrp Svelte SSR attribute spreading includes inherited properties from prototype chain

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-27125). Fix: Update that package to its patched version.
Worth fixing GHSA-f3cj-j4f6-wq85 Svelte: SSR XSS via Insecure Promise Serialization in hydratable

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-f7gr-6p89-r883 Svelte affected by cross-site scripting via spread attributes in Svelte SSR

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-27121). Fix: Update that package to its patched version.
Worth fixing GHSA-h7h7-mm68-gmrc Svelte affected by XSS in SSR `<option>` element

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-27119). Fix: Update that package to its patched version.
Worth fixing GHSA-m56q-vw4c-c2cp Svelte SSR does not validate dynamic element tag names in `<svelte:element>`

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-27122). Fix: Update that package to its patched version.
Worth fixing GHSA-phwv-c562-gvmh Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-27901). Fix: Update that package to its patched version.
Worth fixing GHSA-pr6f-5x2q-rwfp Svelte SSR vulnerable to cross-site scripting via spread attributes

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-42599). Fix: Update that package to its patched version.
Worth fixing GHSA-rcqx-6q8c-2c42 Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-42573). Fix: Update that package to its patched version.
Worth fixing GHSA-2mjp-6q6p-2qxm Undici has an HTTP Request/Response Smuggling issue

/workdirs/scan-c6a748e6-1eb5-49c0-9255-8c97e99ee680/package-lock.json

A package you depend on has a known security hole (CVE-2026-1525). Fix: Update that package to its patched version.

… 24 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.