frzifus/vector

API keys, passwords or tokens committed into the repo.

• Serious heroku-api-key Detected a Heroku API Key, potentially compromising cloud application deployments and operational security.
  lib/vrl/stdlib/src/parse_key_value.rs:711
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  scripts/integration/chronicle/invalidauth.json:5
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  scripts/integration/chronicle/auth.json:5
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  tests/data/ca/intermediate_client/private/intermediate_client.key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  tests/data/ca/intermediate_client/private/localhost.key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  tests/data/ca/intermediate_server/private/dufs-https.key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  tests/data/ca/intermediate_server/private/influxdb-v1-tls.key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  tests/data/ca/intermediate_server/private/elasticsearch-secure.key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  tests/data/ca/intermediate_server/private/kafka.key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  tests/data/ca/intermediate_server/private/intermediate_server.key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  tests/data/ca/intermediate_server/private/localhost.key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  tests/data/ca/intermediate_server/private/postgres.key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  tests/data/host.docker.internal.key:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  tests/data/nats/nats-bad.creds:2
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  tests/data/ca/private/ca.key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  tests/data/nats/nats-jwt.conf:2
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  tests/data/nats/nats-jwt.conf:8
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  tests/data/nats/nats.creds:2
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  tests/data/nats/nats-server.key:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  tests/data/nats/nats-client.key:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious algolia-api-key Identified an Algolia API Key, which could result in unauthorized search operations and data exposure on Algolia-managed platforms.
  website/config.toml:50
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious heroku-api-key Detected a Heroku API Key, potentially compromising cloud application deployments and operational security.
  tests/behavior/transforms/remap.toml:1866
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  lib/k8s-e2e-tests/tests/vector-dd-agent-aggregator.rs:23
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  rfcs/2022-03-15-11851-ingest-opentelemetry-traces.md:48
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  rfcs/2022-03-15-11851-ingest-opentelemetry-traces.md:116
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2023-45133 babel: arbitrary code execution
  website/yarn.lock
  A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-47614 async-graphql Directive Overload
  Cargo.lock
  A package you depend on has a known security hole (CVE-2024-47614). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-30610 AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending
  Cargo.lock
  A package you depend on has a known security hole (CVE-2023-30610). Fix: Update that package to its patched version.
• Worth fixing GHSA-fjx5-qpf4-xjf2 Parsing borsh messages with ZST which are not-copy/clone is unsound
  Cargo.lock
  A package you depend on has a known security hole (GHSA-fjx5-qpf4-xjf2). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-25541 Bytes is a utility library for working with bytes. From version 1.2.1 ...
  Cargo.lock
  A package you depend on has a known security hole (CVE-2026-25541). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-50237 ed25519-dalek: ed25519-dalek: Private Key Extraction Vulnerability
  Cargo.lock
  A package you depend on has a known security hole (CVE-2022-50237). Fix: Update that package to its patched version.
• Worth fixing GHSA-qvc4-78gw-pv8p Adverserial use of `make_bitflags!` macro can cause undefined behavior
  Cargo.lock
  A package you depend on has a known security hole (GHSA-qvc4-78gw-pv8p). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-26964 An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occ ...
  Cargo.lock
  A package you depend on has a known security hole (CVE-2023-26964). Fix: Update that package to its patched version.
• Worth fixing GHSA-8r5v-vm4m-4g25 Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)
  Cargo.lock
  A package you depend on has a known security hole (GHSA-8r5v-vm4m-4g25). Fix: Update that package to its patched version.
• Worth fixing GHSA-q6cp-qfwq-4gcv h2 servers vulnerable to degradation of service with CONTINUATION Flood
  Cargo.lock
  A package you depend on has a known security hole (GHSA-q6cp-qfwq-4gcv). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-12224 idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded
  Cargo.lock
  A package you depend on has a known security hole (CVE-2024-12224). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-12224 idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded
  Cargo.lock
  A package you depend on has a known security hole (CVE-2024-12224). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-27308 CVE-2024-27308 affecting package rpm-ostree for versions less than 2024.4-1
  Cargo.lock
  A package you depend on has a known security hole (CVE-2024-27308). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-11695 mongodb: MongoDB rust driver may unexpectedly disable certificate validation
  Cargo.lock
  A package you depend on has a known security hole (CVE-2025-11695). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-6382 MongoDB Rust driver may issue unintended commands
  Cargo.lock
  A package you depend on has a known security hole (CVE-2024-6382). Fix: Update that package to its patched version.
• Worth fixing GHSA-wvc4-j7g5-4f79 NATS TLS certificate common name validation bypass
  Cargo.lock
  A package you depend on has a known security hole (GHSA-wvc4-j7g5-4f79). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41676 rust-openssl provides OpenSSL bindings for the Rust programming langua ...
  Cargo.lock
  A package you depend on has a known security hole (CVE-2026-41676). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41678 rust-openssl provides OpenSSL bindings for the Rust programming langua ...
  Cargo.lock
  A package you depend on has a known security hole (CVE-2026-41678). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41681 rust-openssl provides OpenSSL bindings for the Rust programming langua ...
  Cargo.lock
  A package you depend on has a known security hole (CVE-2026-41681). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41898 rust-openssl provides OpenSSL bindings for the Rust programming langua ...
  Cargo.lock
  A package you depend on has a known security hole (CVE-2026-41898). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-42327 rust-openssl: rust-openssl: Arbitrary code execution via specially crafted certificate
  Cargo.lock
  A package you depend on has a known security hole (CVE-2026-42327). Fix: Update that package to its patched version.
• Worth fixing GHSA-6hcf-g6gr-hhcr `openssl` `X509Extension::new` and `X509Extension::new_nid` null pointer dereference
  Cargo.lock
  A package you depend on has a known security hole (GHSA-6hcf-g6gr-hhcr). Fix: Update that package to its patched version.
• Worth fixing GHSA-9qwg-crg9-m2vc `openssl` `SubjectAlternativeName` and `ExtendedKeyUsage::other` allow arbitrary file read
  Cargo.lock
  A package you depend on has a known security hole (GHSA-9qwg-crg9-m2vc). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-53159 openssl: OpenSSL: Out-of-bounds Read Vulnerability
  Cargo.lock
  A package you depend on has a known security hole (CVE-2023-53159). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-24898 rust-openssl: rust openssl ssl::select_next_proto use after free
  Cargo.lock
  A package you depend on has a known security hole (CVE-2025-24898). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-67hx-6x53-jw92 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/website/yarn.lock
  A package you depend on has a known security hole (CVE-2023-45133). Fix: Update that package to its patched version.
• Serious MAL-2025-21003 Malicious code in fs (npm)
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/website/yarn.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-5gc2-7c65-8fq8 async-graphql Directive Overload
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole (CVE-2024-47614). Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2023-0125 Logs AWS credentials when TRACE-level logging is enabled
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole (CVE-2023-30610). Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2026-0007 Integer overflow in `BytesMut::reserve`
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole (CVE-2026-25541). Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2022-0093 Double Public Key Signing Function Oracle Attack on `ed25519-dalek`
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole (CVE-2022-50237). Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2024-0332 Degradation of service in h2 servers with CONTINUATION Flood
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2024-0421 `idna` accepts Punycode labels that do not produce any non-ASCII when decoded
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole (CVE-2024-12224). Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2024-0421 `idna` accepts Punycode labels that do not produce any non-ASCII when decoded
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole (CVE-2024-12224). Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2024-0019 Tokens for named pipes may be delivered after deregistration
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole (CVE-2024-27308). Fix: Update that package to its patched version.
• Worth fixing GHSA-32jf-h775-g29h MongoDB Rust driver may issue unintended commands
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole (CVE-2024-6382). Fix: Update that package to its patched version.
• Worth fixing GHSA-3p6w-gv5g-xjw9 MongoDB Rust Driver has certificate validation disabled when `tlsInsecure=False` appears in connection string
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole (CVE-2025-11695). Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2023-0044 `openssl` `X509VerifyParamRef::set_host` buffer over-read
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole (CVE-2023-53159). Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2024-0357 `MemBio::get_buf` has undefined behavior with empty buffers
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2025-0004 ssl::select_next_proto use after free
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole (CVE-2025-24898). Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2025-0022 Use-After-Free in `Md::fetch` and `Cipher::fetch`
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-8c75-8mhr-p7r9 rust-openssl has incorrect bounds assertion in aes key wrap
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole (CVE-2026-41678). Fix: Update that package to its patched version.
• Worth fixing GHSA-ghm9-cr32-g9qj rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole (CVE-2026-41681). Fix: Update that package to its patched version.
• Worth fixing GHSA-hppc-g8h3-xhp3 rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole (CVE-2026-41898). Fix: Update that package to its patched version.
• Worth fixing GHSA-pqf5-4pqq-29f5 rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole (CVE-2026-41676). Fix: Update that package to its patched version.
• Worth fixing GHSA-xp3w-r5p5-63rr rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole (CVE-2026-42327). Fix: Update that package to its patched version.
• Worth fixing GHSA-xv59-967r-8726 rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole (CVE-2026-44662). Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2026-0179 Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2026-0180 Panic decoding a malformed `hstore` value allows denial of service
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2025-0009 Some AES functions may panic when overflow checking is enabled.
  /workdirs/scan-ab48c422-bd59-4076-9e58-39e2a2bfd918/Cargo.lock
  A package you depend on has a known security hole (CVE-2025-4432). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0