gitsafehub
github.com/jcrben/vibe-trading ↗

jcrben/vibe-trading

scanned 2026-08-13 · git 54820e5
2 of 6 checks flagged a security issue
🟡 Worth a look
Only 3 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets5Vulnerable dependencies13Known OSS vulnerabilities—Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ 5 found

API keys, passwords or tokens committed into the repo.

  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    agent/scripts/w4a_patch_blog.py:31
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    agent/scripts/w4a_run_benches.py:48
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    agent/scripts/w4a_run_benches.py:50
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    agent/src/skills/social-media-intelligence/SKILL.md:459
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    agent/src/skills/social-media-intelligence/SKILL.md:459
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 13 found

Packages you depend on that have known security holes (CVEs).

  • Worth fixing CVE-2026-45249 Apache ECharts has a cross-site scripting (XSS) vulnerability
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-45249). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-33245 react-router: React Router: Cross-Site Scripting vulnerability via untrusted React Server Component redirects
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33245). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-34077 react-router: React Router: Denial of Service via client-side Cross-Site Scripting in RSC redirect handling
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-34077). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-42211 react-router: React Router: Remote Code Execution via prototype pollution in Framework Mode
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-42211). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-42342 react-router: @remix-run/server-runtime: React Router / Remix: Denial of Service via unbounded path expansion in __manifest endpoint
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-42342). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-55685 react-router: @remix-run/server-runtime: React Router: Denial of Service via unauthenticated manifest endpoint requests
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-55685). Fix: Update that package to its patched version.
  • Worth fixing GHSA-qwww-vcr4-c8h2 React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
    frontend/package-lock.json
    A package you depend on has a known security hole (GHSA-qwww-vcr4-c8h2). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-33244 react-router: React Router: Cross-Site Scripting (XSS) via improper HTTP Location header neutralization
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-33244). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-40181 react-router: React Router: Open redirect vulnerability via specially crafted URLs
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-40181). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53666 react-router: React Router: Information disclosure via client-side constructor execution
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-53666). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53667 react-router: React Router: Untrusted redirects due to missing protocol validation
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-53667). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53669 react-router: React Router: Open Redirect vulnerability via backslashes in navigation components
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-53669). Fix: Update that package to its patched version.
  • Minor CVE-2026-53663 react-router: @remix-run/server-runtime: React Router: Insufficient CSRF protection allows integrity impact
    frontend/package-lock.json
    A package you depend on has a known security hole (CVE-2026-53663). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ timed out

Your dependencies cross-checked against the OSV vulnerability database.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OSV-Scanner v1.9.2 · Apache-2.0

error: timeout after 400s

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: pypi:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.