Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
curl-auth-header Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.Packages you depend on that have known security holes (CVEs).
This check didn’t finish — that’s not the same as “clean.” Try Check again above.
Your dependencies cross-checked against the OSV vulnerability database.
GHSA-4wrc-f8pq-fpqp Pivotal Spring Framework contains unsafe Java deserialization methodsGHSA-c4q5-6c82-3qpw Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux ApplicationsGHSA-mf92-479x-3373 Spring Security HTTP Headers Are not Written Under Some ConditionsGHSA-3wrr-7qpf-2prh jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()GHSA-5jmj-h7xm-6q6v jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnorePropertiesGHSA-hgj6-7826-r7m5 jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)GHSA-j3rv-43j4-c7qm jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiationGHSA-rmj7-2vxq-3g9f jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)GHSA-78wr-2p64-hpwj Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReaderGHSA-j288-q9x7-2f5v Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputsGHSA-gmg8-593g-7mv3 Apache POI OOXML Vulnerable to Improper Input Validation in OOXML File ParsingGHSA-4gc7-5j7h-4qph Spring Framework DataBinder Case Sensitive Match ExceptionGHSA-3mc7-4q67-w48m Uncontrolled Resource Consumption in snakeyamlGHSA-98wm-3w3q-mw94 snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds WriteGHSA-9w3m-gqgf-c4p9 snakeYAML before 1.32 vulnerable to Denial of Service due to Out-of-bounds WriteGHSA-c4r9-r8fh-9vj2 snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds WriteGHSA-hhhw-99gj-p3c3 snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds WriteGHSA-mjmj-j48q-9wg2 SnakeYaml Constructor Deserialization Remote Code ExecutionGHSA-w37g-rhq8-7m4j Snakeyaml vulnerable to Stack overflow leading to denial of serviceGHSA-25qh-j22f-pwp8 QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processingGHSA-pr98-23f8-jwxv QOS.CH logback-core Expression Language Injection vulnerabilityGHSA-h46c-h94j-95f3 jackson-core can throw a StackoverflowError when processing deeply nested dataGHSA-r7wm-3cxj-wff9 jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)GHSA-wf8f-6423-gfxg Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocationGHSA-3p8m-j85q-pgmj Netty's decoders vulnerable to DoS via zip bomb style attackCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.