haessr/fizzy

API keys, passwords or tokens committed into the repo.

• Serious slack-webhook-url Discovered a Slack Webhook, which could lead to unauthorized message posting and data leakage in Slack channels.
  test/models/webhook_test.rb:57
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious slack-webhook-url Discovered a Slack Webhook, which could lead to unauthorized message posting and data leakage in Slack channels.
  test/models/webhook/delivery_test.rb:167
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious slack-webhook-url Discovered a Slack Webhook, which could lead to unauthorized message posting and data leakage in Slack channels.
  test/models/webhook_test.rb:57
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious slack-webhook-url Discovered a Slack Webhook, which could lead to unauthorized message posting and data leakage in Slack channels.
  test/models/webhook/delivery_test.rb:167
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious slack-webhook-url Discovered a Slack Webhook, which could lead to unauthorized message posting and data leakage in Slack channels.
  test/models/webhook_test.rb:57
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious slack-webhook-url Discovered a Slack Webhook, which could lead to unauthorized message posting and data leakage in Slack channels.
  test/models/webhook/delivery_test.rb:167
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  test/fixtures/webhooks.yml:6
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  test/fixtures/webhooks.yml:16
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  test/fixtures/webhooks.yml:6
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  test/fixtures/webhooks.yml:16
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  test/fixtures/webhooks.yml:6
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  test/fixtures/webhooks.yml:16
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2026-54906 concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: Synchronization flaw in ReadWriteLock allows unauthorized lock release and denial of service
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54906). Fix: Update that package to its patched version.
• Serious CVE-2026-33210 ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33210). Fix: Update that package to its patched version.
• Serious CVE-2026-42257 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-42257). Fix: Update that package to its patched version.
• Serious CVE-2026-39324 Rack::Session is a session management implementation for Rack. From 2. ...
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-39324). Fix: Update that package to its patched version.
• Worth fixing GHSA-53g2-mvcc-q9x3 Stored XSS via HTMLParser attribute injection on paste
  Gemfile.lock
  A package you depend on has a known security hole (GHSA-53g2-mvcc-q9x3). Fix: Update that package to its patched version.
• Worth fixing GHSA-g9jg-w8vm-g96v Trix has a stored XSS vulnerability through its attachment attribute
  Gemfile.lock
  A package you depend on has a known security hole (GHSA-g9jg-w8vm-g96v). Fix: Update that package to its patched version.
• Worth fixing GHSA-qmpg-8xg6-ph5q Trix has a Stored XSS vulnerability through serialized attributes
  Gemfile.lock
  A package you depend on has a known security hole (GHSA-qmpg-8xg6-ph5q). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-35611 addressable: Addressable: Denial of Service via crafted URI templates
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-35611). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-14762 aws-sdk-ruby: AWS SDK for Ruby: Data integrity compromise via missing cryptographic key commitment
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-14762). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33306 github.com/bcrypt-ruby/bcrypt-ruby: bcrypt-ruby (JRuby): Weakened password hashing due to integer overflow
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33306). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54904 concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: Denial of Service due to infinite loop in AtomicReference#update
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54904). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54905 concurrent-ruby: Concurrent-ruby: Incorrect write lock granting leading to broken mutual exclusion
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54905). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41316 erb: ERB: Arbitrary code execution via deserialization bypass
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-41316). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-45363 ruby-jwt: ruby-jwt: Authentication bypass due to empty key in HMAC verification
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-45363). Fix: Update that package to its patched version.
• Worth fixing GHSA-9wjq-cp2p-hrgf SVG `href` attribute bypasses local-reference restriction in Loofah
  Gemfile.lock
  A package you depend on has a known security hole (GHSA-9wjq-cp2p-hrgf). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54522 MessagePack for Ruby is an implementation of the MessagePack binary se ...
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54522). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-42245 ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-42245). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-42246 net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-42246). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-42258 ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-42258). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-42256 ruby/net-imap: ruby: Net::IMAP: Denial of Service via large iteration count in SCRAM authentication
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-42256). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-47240 net-imap: Net::IMAP: Command injection via non-synchronizing literals
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-47240). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-47242 Net::IMAP implements Internet Message Access Protocol (IMAP) client fu ...
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-47242). Fix: Update that package to its patched version.
• Worth fixing GHSA-c4rq-3m3g-8wgx Nokogiri CSS selector tokenizer has regular expression backtracking
  Gemfile.lock
  A package you depend on has a known security hole (GHSA-c4rq-3m3g-8wgx). Fix: Update that package to its patched version.
• Worth fixing GHSA-5prr-v3j2-97mh Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`
  Gemfile.lock
  A package you depend on has a known security hole (GHSA-5prr-v3j2-97mh). Fix: Update that package to its patched version.
• Worth fixing GHSA-v2fc-qm4h-8hqv Nokogiri XSLT transform has a memory leak
  Gemfile.lock
  A package you depend on has a known security hole (GHSA-v2fc-qm4h-8hqv). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-33qg-7wpp-89cq Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-39324). Fix: Update that package to its patched version.
• Worth fixing GHSA-53g2-mvcc-q9x3 Trix: Stored XSS via HTMLParser attribute injection on paste
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-g9jg-w8vm-g96v Trix has a stored XSS vulnerability through its attachment attribute
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-qmpg-8xg6-ph5q Trix has a Stored XSS vulnerability through serialized attributes
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-h27x-rffw-24p4 Addressable has a Regular Expression Denial of Service in Addressable templates
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-35611). Fix: Update that package to its patched version.
• Worth fixing GHSA-2xgq-q749-89fq AWS SDK for Ruby's S3 Encryption Client has a Key Commitment Issue
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-14762). Fix: Update that package to its patched version.
• Worth fixing GHSA-f27w-vcwj-c954 bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRuby
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33306). Fix: Update that package to its patched version.
• Worth fixing GHSA-h8w8-99g7-qmvj Concurrent Ruby : `AtomicReference#update` livelocks when the stored value is `Float::NAN`
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54904). Fix: Update that package to its patched version.
• Worth fixing GHSA-wv3x-4vxv-whpp Concurrent Ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54905). Fix: Update that package to its patched version.
• Worth fixing GHSA-q339-8rmv-2mhv ERB has an @_init deserialization guard bypass via def_module / def_method / def_class
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-41316). Fix: Update that package to its patched version.
• Worth fixing GHSA-3m6g-2423-7cp3 Ruby JSON has a format string injection vulnerability
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33210). Fix: Update that package to its patched version.
• Worth fixing GHSA-c32j-vqhx-rx3x ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-45363). Fix: Update that package to its patched version.
• Worth fixing GHSA-9wjq-cp2p-hrgf Loofah: SVG `href` attribute bypasses local-reference restriction
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-46q3-7gv7-qmgg Net::IMAP: Command Injection via ID command argument
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-47242). Fix: Update that package to its patched version.
• Worth fixing GHSA-75xq-5h9v-w6px net-imap vulnerable to command Injection via unvalidated Symbol inputs
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-42258). Fix: Update that package to its patched version.
• Worth fixing GHSA-87pf-fpwv-p7m7 net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-42256). Fix: Update that package to its patched version.
• Worth fixing GHSA-8p34-64r3-mwg8 Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-47240). Fix: Update that package to its patched version.
• Worth fixing GHSA-hm49-wcqc-g2xg net-imap vulnerable to command Injection via "raw" arguments to multiple commands
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-42257). Fix: Update that package to its patched version.
• Worth fixing GHSA-vcgp-9326-pqcp net-imap vulnerable to STARTTLS stripping via invalid response timing
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-42246). Fix: Update that package to its patched version.
• Worth fixing GHSA-5prr-v3j2-97mh Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-57235). Fix: Update that package to its patched version.
• Worth fixing GHSA-c4rq-3m3g-8wgx Nokogiri CSS selector tokenizer has regular expression backtracking
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-v2fc-qm4h-8hqv Nokogiri XSLT transform has a memory leak
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-wx95-c6cv-8532 Nokogiri does not check the return value from xmlC14NExecute
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing GHSA-2vqw-3mp8-cgmx Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-47737). Fix: Update that package to its patched version.
• Worth fixing GHSA-qpgp-93vx-g8v8 Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
  /workdirs/scan-de646211-e8a7-4a60-b9c0-c993556fa06a/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-47736). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0