Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.curl-auth-header Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.curl-auth-header Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.curl-auth-header Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.curl-auth-header Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.Packages you depend on that have known security holes (CVEs).
Nothing found by this check. ✓
Your dependencies cross-checked against the OSV vulnerability database.
GHSA-658g-p7jg-wx5g Axios npm Supply Chain Incident Impacting @usebruno/cliGHSA-m7jm-9gc2-mpf2 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity namesGHSA-m7jm-9gc2-mpf2 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity namesGHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundaryGHSA-wf6x-7x77-mvgw Immutable is vulnerable to Prototype PollutionGHSA-wf6x-7x77-mvgw Immutable is vulnerable to Prototype PollutionGHSA-h7cp-r72f-jxh6 pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algosGHSA-v62p-rq8g-8h59 pbkdf2 silently disregards Uint8Array input, returning static keysGHSA-xq3m-2v4x-88gg Arbitrary code execution in protobufjsGHSA-95m3-7q98-8xr5 sha.js is missing type checks leading to hash rewind and passing on crafted dataGHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op valuesGHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op valuesGHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited inputGHSA-fv7c-fp4j-7gwp @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious inputGHSA-fv7c-fp4j-7gwp @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious inputGHSA-968p-4wvh-cqc8 Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groupsGHSA-5375-pq7m-f5r2 @grpc/grpc-js: A malformed request can cause a server crashGHSA-99f4-grh7-6pcq @grpc/grpc-js: An incoming malformed compressed message can cause a client or server crashGHSA-345p-7cg4-v4c7 @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuseGHSA-8r9q-7v3j-jr4g Anthropic's MCP TypeScript SDK has a ReDoS vulnerabilityGHSA-w48q-cv73-mx4w Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by defaultGHSA-q6x5-8v7m-xcrf protobufjs has overlong UTF-8 decodingGHSA-2v35-w6hq-6mfw xmldom: Uncontrolled recursion in XML serialization leads to DoSGHSA-f6ww-3ggp-fr8h xmldom has XML injection through unvalidated DocumentType serializationGHSA-j759-j44w-7fr8 xmldom has XML node injection through unvalidated comment serializationCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.