maybe-finance/maybe

API keys, passwords or tokens committed into the repo.

• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  test/controllers/settings/api_keys_controller_test.rb:36
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  test/models/api_key_test.rb:11
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  test/system/settings/api_keys_test.rb:57
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  test/system/settings/api_keys_test.rb:151
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2026-33195 Rails: Active Storage: Active Storage (Rails): Arbitrary file access via path traversal in blob keys
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33195). Fix: Update that package to its patched version.
• Serious CVE-2026-33202 rails: Active Storage: Unintended file deletion via crafted blob keys
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33202). Fix: Update that package to its patched version.
• Serious CVE-2026-54906 concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: Synchronization flaw in ReadWriteLock allows unauthorized lock release and denial of service
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54906). Fix: Update that package to its patched version.
• Serious CVE-2026-42257 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF sequences in unvalidated input
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-42257). Fix: Update that package to its patched version.
• Serious GHSA-353f-x4gh-cqq8 Nokogiri patches vendored libxml2 to resolve multiple CVEs
  Gemfile.lock
  A package you depend on has a known security hole (GHSA-353f-x4gh-cqq8). Fix: Update that package to its patched version.
• Serious CVE-2026-39324 Rack::Session is a session management implementation for Rack. From 2. ...
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-39324). Fix: Update that package to its patched version.
• Serious CVE-2026-34060 Ruby LSP is an implementation of the language server protocol for Ruby ...
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-34060). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33168 actionview: Action View: Cross-Site Scripting (XSS) via blank HTML attribute names
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33168). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-55193 activerecord: Active Record ANSI Injection Vulnerability
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-55193). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-24293 activestorage: Code injection in Active Storage when used in conjunction with the image_processing gem
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-24293). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33174 Rails: Active Storage: Rails Active Storage: Denial of Service via unbounded Range header
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33174). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-66066 activestorage: Active Storage: Remote Code Execution via Unsafe libvips Operations
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-66066). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33173 Rails: Active Storage: Rails Active Storage: Content type bypass via arbitrary metadata in direct uploads
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33173). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33658 rails: activestorage: Active Storage: Denial of Service via HTTP Range header processing
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33658). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33176 Rails: Active Support: Active Support: Denial of Service via large scientific notation strings
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33176). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33169 rails: rails-activesupport: Active Support: Denial of Service via crafted long digit strings
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33169). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33170 Rails: Active Support: Active Support: Cross-Site Scripting (XSS) due to improper HTML safety flag propagation in SafeBuffer#%
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33170). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-35611 addressable: Addressable: Denial of Service via crafted URI templates
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-35611). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-14762 aws-sdk-ruby: AWS SDK for Ruby: Data integrity compromise via missing cryptographic key commitment
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-14762). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-33306 github.com/bcrypt-ruby/bcrypt-ruby: bcrypt-ruby (JRuby): Weakened password hashing due to integer overflow
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33306). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54904 concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: Denial of Service due to infinite loop in AtomicReference#update
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54904). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54905 concurrent-ruby: Concurrent-ruby: Incorrect write lock granting leading to broken mutual exclusion
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54905). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44312 css_parser: css_parser: Man-in-the-Middle attack due to improper HTTPS certificate validation
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-44312). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-41316 erb: ERB: Arbitrary code execution via deserialization bypass
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-41316). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-54297 faraday: Faraday: Denial of Service via crafted nested query strings
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54297). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-r4mg-4433-c7g3 Active Storage allowed transformation methods that were potentially unsafe
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-24293). Fix: Update that package to its patched version.
• Serious GHSA-xr9x-r78c-5hrm Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-66066). Fix: Update that package to its patched version.
• Serious GHSA-353f-x4gh-cqq8 Nokogiri patches vendored libxml2 to resolve multiple CVEs
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Serious GHSA-33qg-7wpp-89cq Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-39324). Fix: Update that package to its patched version.
• Worth fixing GHSA-76r7-hhxj-r776 Active Record logging vulnerable to ANSI escape injection
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-55193). Fix: Update that package to its patched version.
• Worth fixing GHSA-73f9-jhhh-hr5m Rails Active Storage has possible glob injection in its DiskService
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33202). Fix: Update that package to its patched version.
• Worth fixing GHSA-9xrj-h377-fr87 Rails Active Storage has possible Path Traversal in DiskService
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33195). Fix: Update that package to its patched version.
• Worth fixing GHSA-p9fm-f462-ggrg Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33658). Fix: Update that package to its patched version.
• Worth fixing GHSA-qcfx-2mfw-w4cg Rails Active Storage has possible content type bypass via metadata in direct uploads
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33173). Fix: Update that package to its patched version.
• Worth fixing GHSA-r46p-8f7g-vvvg Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33174). Fix: Update that package to its patched version.
• Worth fixing GHSA-2j26-frm8-cmj9 Rails Active Support has a possible DoS vulnerability in its number helpers
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33176). Fix: Update that package to its patched version.
• Worth fixing GHSA-89vf-4333-qx8v Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33170). Fix: Update that package to its patched version.
• Worth fixing GHSA-cg4j-q9v8-6v38 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33169). Fix: Update that package to its patched version.
• Worth fixing GHSA-h27x-rffw-24p4 Addressable has a Regular Expression Denial of Service in Addressable templates
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-35611). Fix: Update that package to its patched version.
• Worth fixing GHSA-2xgq-q749-89fq AWS SDK for Ruby's S3 Encryption Client has a Key Commitment Issue
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-14762). Fix: Update that package to its patched version.
• Worth fixing GHSA-f27w-vcwj-c954 bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRuby
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33306). Fix: Update that package to its patched version.
• Worth fixing GHSA-h8w8-99g7-qmvj Concurrent Ruby : `AtomicReference#update` livelocks when the stored value is `Float::NAN`
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54904). Fix: Update that package to its patched version.
• Worth fixing GHSA-wv3x-4vxv-whpp Concurrent Ruby: `ReentrantReadWriteLock` read-count overflow grants a write lock without exclusivity
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54905). Fix: Update that package to its patched version.
• Worth fixing GHSA-9pmc-p236-855h Ruby CSS Parser: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-53727). Fix: Update that package to its patched version.
• Worth fixing GHSA-ff6c-w6qf-7xqc CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-44312). Fix: Update that package to its patched version.
• Worth fixing GHSA-q339-8rmv-2mhv ERB has an @_init deserialization guard bypass via def_module / def_method / def_class
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-41316). Fix: Update that package to its patched version.
• Worth fixing GHSA-33mh-2634-fwr2 Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-25765). Fix: Update that package to its patched version.
• Worth fixing GHSA-98m9-hrrm-r99r Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-54297). Fix: Update that package to its patched version.
• Worth fixing GHSA-c32j-vqhx-rx3x ruby-jwt: Empty-key HMAC bypass; cross-language sibling of CVE-2026-44351
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-45363). Fix: Update that package to its patched version.
• Worth fixing GHSA-9wjq-cp2p-hrgf Loofah: SVG `href` attribute bypasses local-reference restriction
  /workdirs/scan-8b64ffa2-ca70-4cef-b9bb-969bbaf43e2e/Gemfile.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

• Worth fixing guarddog-npm-npm-install-script npm-install-script match in @biomejs/biome 1.9.4
  @biomejs/biome
  A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.

via Guarddog v2.10.0 · Apache-2.0