geuis/onc-ehr-incentives-program-payout-data

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 120s

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2022-32224 activerecord: Possible RCE escalation bug with Serialized Columns in Active Record
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-32224). Fix: Update that package to its patched version.
• Serious CVE-2020-8165 rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8165). Fix: Update that package to its patched version.
• Serious CVE-2015-4412 rubygem-bson: data injection vulnerability through a crafted ObjectId
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2015-4412). Fix: Update that package to its patched version.
• Serious CVE-2022-30123 rubygem-rack: crafted requests can cause shell escape sequences
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-30123). Fix: Update that package to its patched version.
• Serious CVE-2015-1820 rubygem-rest-client: session fixation vulnerability Set-Cookie headers present in an HTTP 30x redirection responses
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2015-1820). Fix: Update that package to its patched version.
• Worth fixing CVE-2013-1854 rubygem-activerecord: attribute_dos Symbol DoS vulnerability
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-1854). Fix: Update that package to its patched version.
• Worth fixing CVE-2014-3482 rubygem-activerecord: SQL injection vulnerability in 'bitstring' quoting
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2014-3482). Fix: Update that package to its patched version.
• Worth fixing CVE-2022-44566 rubygem-activerecord: Denial of Service
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-44566). Fix: Update that package to its patched version.
• Worth fixing CVE-2013-3221 rubygem-activerecord: Data-type injection attacks due absent database column data type (input vs stored value) check
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-3221). Fix: Update that package to its patched version.
• Worth fixing CVE-2015-7577 rubygem-activerecord: Nested attributes rejection proc bypass in Active Record
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2015-7577). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-55193 activerecord: Active Record ANSI Injection Vulnerability
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-55193). Fix: Update that package to its patched version.
• Worth fixing CVE-2013-1856 XML Parsing Vulnerability affecting JRuby users
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-1856). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-22796 rubygem-activesupport: Regular Expression Denial of Service
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-22796). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33176 Rails: Active Support: Active Support: Denial of Service via large scientific notation strings
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33176). Fix: Update that package to its patched version.
• Worth fixing CVE-2015-3227 rubygem-activesupport: Possible Denial of Service attack in Active Support in merge_element()
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2015-3227). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-28120 rubygem-activesupport: Possible XSS in SafeBuffer#bytesplice
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-28120). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33169 rails: rails-activesupport: Active Support: Denial of Service via crafted long digit strings
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33169). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33170 Rails: Active Support: Active Support: Cross-Site Scripting (XSS) due to improper HTML safety flag propagation in SafeBuffer#%
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33170). Fix: Update that package to its patched version.
• Worth fixing CVE-2015-4411 rubygem-moped: Denial of Service with crafted ObjectId string (incomplete fix for CVE-2015-4410)
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2015-4411). Fix: Update that package to its patched version.
• Worth fixing CVE-2017-1002201 In haml versions prior to version 5.0.0.beta.2, when using user input ...
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2017-1002201). Fix: Update that package to its patched version.
• Worth fixing CVE-2014-10077 rubygem-i18n: denial of service in Hash#slice in lib/i18n/core_ext/hash.rb
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2014-10077). Fix: Update that package to its patched version.
• Worth fixing CVE-2013-4492 rubygem-i18n: cross-site scripting flaw in exception handling
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-4492). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-10663 rubygem-json: Unsafe object creation vulnerability in JSON
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-10663). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-2302 Mongoid::Criteria.from_hash method allows arbitrary method calls
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-2302). Fix: Update that package to its patched version.
• Worth fixing CVE-2015-4410 rubygem-moped: Denial of Service with crafted ObjectId string
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2015-4410). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-3hhc-qp5v-9p2j Active Record RCE bug with Serialized Columns
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-32224). Fix: Update that package to its patched version.
• Serious GHSA-f57c-hx33-hvh8 Active Record component in Ruby on Rails has a data-type injection vulnerability
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-3221). Fix: Update that package to its patched version.
• Serious GHSA-h6rj-8r3c-9gpj bson is vulnerable to denial of service due to incorrect regex validation
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2015-4412). Fix: Update that package to its patched version.
• Serious GHSA-wq4h-7r42-5hrr Possible shell escape sequence injection vulnerability in Rack
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-30123). Fix: Update that package to its patched version.
• Serious GHSA-3fhf-6939-qg8p rest-client Gem Vulnerable to Session Fixation
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2015-1820). Fix: Update that package to its patched version.
• Worth fixing GHSA-579w-22j4-4749 Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-44566). Fix: Update that package to its patched version.
• Worth fixing GHSA-76r7-hhxj-r776 Active Record logging vulnerable to ANSI escape injection
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-55193). Fix: Update that package to its patched version.
• Worth fixing GHSA-mhwp-qhpc-h3jm SQL Injection in Active Record
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2014-3482). Fix: Update that package to its patched version.
• Worth fixing GHSA-xrr6-3pc4-m447 Active Record Improper Access Control
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2015-7577). Fix: Update that package to its patched version.
• Worth fixing GHSA-2j26-frm8-cmj9 Rails Active Support has a possible DoS vulnerability in its number helpers
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33176). Fix: Update that package to its patched version.
• Worth fixing GHSA-89vf-4333-qx8v Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33170). Fix: Update that package to its patched version.
• Worth fixing GHSA-cg4j-q9v8-6v38 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33169). Fix: Update that package to its patched version.
• Worth fixing GHSA-pj73-v5mw-pm9j Possible XSS Security Vulnerability in SafeBuffer#bytesplice
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-28120). Fix: Update that package to its patched version.
• Worth fixing GHSA-qh4w-7pw3-p4rp BSON rubygem contains potential denial of service
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2015-4411). Fix: Update that package to its patched version.
• Worth fixing GHSA-r53w-g4xm-3gc6 Haml vulnerable to cross-site scripting
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2017-1002201). Fix: Update that package to its patched version.
• Worth fixing GHSA-34hf-g744-jw64 i18n Vulnerable to Denial of Service Attack
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2014-10077). Fix: Update that package to its patched version.
• Worth fixing GHSA-jphg-qwrw-7w9g Unsafe object creation in json RubyGem
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-10663). Fix: Update that package to its patched version.
• Worth fixing GHSA-f93j-hmcr-jcwh Moped Rubygem Data Injection Vulnerability
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2015-4410). Fix: Update that package to its patched version.
• Worth fixing GHSA-22f2-v57c-j9cx Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2024-25126). Fix: Update that package to its patched version.
• Worth fixing GHSA-3h57-hmj3-gj3p Rack has possible DoS Vulnerability in Multipart MIME parsing
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-27530). Fix: Update that package to its patched version.
• Worth fixing GHSA-5f9h-9pjv-v6j7 Directory traversal in Rack::Directory app bundled with Rack
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8161). Fix: Update that package to its patched version.
• Worth fixing GHSA-5r2p-j47h-mhpg Rack vulnerable to Cross-site Scripting
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2018-16471). Fix: Update that package to its patched version.
• Worth fixing GHSA-625h-95r8-8xpm Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-59830). Fix: Update that package to its patched version.
• Worth fixing GHSA-65f5-mfpf-vfhj Denial of service via header parsing in Rack
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-44570). Fix: Update that package to its patched version.
• Worth fixing GHSA-6xw4-3v39-52mm Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing
  /workdirs/scan-4d9583a7-01f2-486f-bb2e-0a9d4f4f67c5/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-61919). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0