gitsafehub
github.com/limingxinleo/web-frameworks ↗

limingxinleo/web-frameworks

scanned 2026-08-07 · git b2a8a20
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets11Vulnerable dependencies105Known OSS vulnerabilities—Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ 11 found

API keys, passwords or tokens committed into the repo.

  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    crystal/amber/config/environments/production.yml:1
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    crystal/lucky/config/setup.cr:12
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    crystal/amber/config/application.cr:52
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    java/act/src/main/resources/conf/app.properties:580
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    php/spiral/.env:11
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    php/yii-swoole/config/web.php:12
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    php/yii/config/web.php:12
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    python/masonite/config/application.py:4
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    python/masonite/config/storage.py:34
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    ruby/rails-api/config/secrets.yml:7
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    ruby/rails/config/secrets.yml:7
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 105 found · 5 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2025-30223 Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input
    go/beego/go.mod
    A package you depend on has a known security hole (CVE-2025-30223). Fix: Update that package to its patched version.
  • Serious CVE-2024-25124 Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials
    go/fiber/go.mod
    A package you depend on has a known security hole (CVE-2024-25124). Fix: Update that package to its patched version.
  • Serious CVE-2024-38513 Session Middleware Token Injection Vulnerability
    go/fiber/go.mod
    A package you depend on has a known security hole (CVE-2024-38513). Fix: Update that package to its patched version.
  • Serious CVE-2025-66630 github.com/gofiber/fiber/v2: Fiber: Predictable UUIDs from randomness source errors can lead to security bypasses
    go/fiber/go.mod
    A package you depend on has a known security hole (CVE-2025-66630). Fix: Update that package to its patched version.
  • Serious CVE-2025-12543 undertow-core: Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF
    java/light-4j/pom.xml
    A package you depend on has a known security hole (CVE-2025-12543). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-40464 Beego privilege escalation vulnerability
    go/beego/go.mod
    A package you depend on has a known security hole (CVE-2024-40464). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-40465 Beego privilege escalation vulnerability
    go/beego/go.mod
    A package you depend on has a known security hole (CVE-2024-40465). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-55885 Beego has Collision Hazards of MD5 in Cache Key Filenames
    go/beego/go.mod
    A package you depend on has a known security hole (CVE-2024-55885). Fix: Update that package to its patched version.
  • Worth fixing GHSA-vrw8-fxc6-2r93 chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes
    go/chi/go.mod
    A package you depend on has a known security hole (GHSA-vrw8-fxc6-2r93). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-54801 Fiber Crashes in BodyParser Due to Unvalidated Large Slice Index in Decoder
    go/fiber/go.mod
    A package you depend on has a known security hole (CVE-2025-54801). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-25882 Fiber has a Denial of Service Vulnerability via Route Parameter Overflow
    go/fiber/go.mod
    A package you depend on has a known security hole (CVE-2026-25882). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-42554 Fiber vulnerable to XSS in AutoFormat Content Negotiation
    go/fiber/go.mod
    A package you depend on has a known security hole (CVE-2026-42554). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-45045 GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForward
    go/fiber/go.mod
    A package you depend on has a known security hole (CVE-2026-45045). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-6481 logback: A serialization vulnerability in logback receiver
    java/activej/pom.xml
    A package you depend on has a known security hole (CVE-2023-6481). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-12798 logback-core: arbitrary code execution via JaninoEventEvaluator
    java/activej/pom.xml
    A package you depend on has a known security hole (CVE-2024-12798). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-11226 ch.qos.logback/logback-core: Conditional abitrary code execution in logback-core
    java/activej/pom.xml
    A package you depend on has a known security hole (CVE-2025-11226). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-42583 netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder
    java/jooby/pom.xml
    A package you depend on has a known security hole (CVE-2026-42583). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-59901 io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)
    java/jooby/pom.xml
    A package you depend on has a known security hole (CVE-2026-59901). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-58057 netty-codec: netty-codec-compression: Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack
    java/jooby/pom.xml
    A package you depend on has a known security hole (CVE-2025-58057). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-33870 io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values
    java/jooby/pom.xml
    A package you depend on has a known security hole (CVE-2026-33870). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-42584 netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion
    java/jooby/pom.xml
    A package you depend on has a known security hole (CVE-2026-42584). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-42587 netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression
    java/jooby/pom.xml
    A package you depend on has a known security hole (CVE-2026-42587). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-55831 io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing
    java/jooby/pom.xml
    A package you depend on has a known security hole (CVE-2026-55831). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-55833 netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification
    java/jooby/pom.xml
    A package you depend on has a known security hole (CVE-2026-55833). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-56745 netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec
    java/jooby/pom.xml
    A package you depend on has a known security hole (CVE-2026-56745). Fix: Update that package to its patched version.
… 80 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ timed out

Your dependencies cross-checked against the OSV vulnerability database.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OSV-Scanner v1.9.2 · Apache-2.0

error: timeout after 120s

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.