Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.Packages you depend on that have known security holes (CVEs).
CVE-2024-41110 moby: Authz zero length regressionCVE-2022-1996 go-restful: Authorization Bypass Through User-Controlled KeyCVE-2019-25211 github.com/gin-contrib/cors: Gin mishandles a wildcard in the origin string in github.com/gin-contrib/corsCVE-2020-26892 The JWT library in NATS nats-server before 2.1.9 has Incorrect Access ...CVE-2026-33186 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validationCVE-2026-41602 github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementationCVE-2022-23648 containerd: insecure handling of image volumesCVE-2024-25621 github.com/containerd/containerd: containerd local privilege escalationCVE-2021-21334 plugin: information leak between containers via environment variablesCVE-2021-32760 containerd: pulling and extracting crafted container image may result in Unix file permission changesCVE-2021-41103 containerd: insufficiently restricted permissions on container root and plugin directoriesCVE-2022-23471 containerd is an open source container runtime. A bug was found in con ...CVE-2022-31030 containerd is an open source container runtime. A bug was found in the ...CVE-2023-25153 containerd: OCI image importer memory exhaustionCVE-2023-25173 containerd: Supplementary groups are not set up properlyCVE-2024-40635 containerd: containerd has an integer overflow in User ID handlingCVE-2025-64329 github.com/containerd/containerd: containerd: Memory exhaustion via CRI Attach implementation goroutine leaksGHSA-7ww5-4wqc-m92c containerd allows RAPL to be accessible to a containerCVE-2023-2253 distribution/distribution: DoS from malicious API requestCVE-2023-28840 moby: Encrypted overlay network may be unauthenticatedCVE-2026-34040 Moby: Moby: Authorization bypass vulnerabilityCVE-2021-41091 moby: data directory contains subdirectories with insufficiently restricted permissions, which could lead to directory traversalCVE-2022-24769 moby: Default inheritable capabilities for linux container should be emptyCVE-2022-36109 moby: supplementary groups mishandlingCVE-2023-28841 moby: Encrypted overlay network traffic may be unencryptedYour dependencies cross-checked against the OSV vulnerability database.
GO-2026-4762 Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpcGO-2024-3321 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/cryptoGO-2026-5005 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agentGO-2026-5006 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agentGO-2026-5017 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/sshGO-2026-5019 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/sshGO-2026-5020 Invoking infinite loop on large channel writes in golang.org/x/crypto/sshGO-2026-5021 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhostsGO-2026-5023 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/sshGHSA-wf45-q9ch-q8gh Apache Thrift TFramedTransport Go language implementation has an Integer Overflow or Wraparound vulnerabilityGO-2022-0322 Uncontrolled resource consumption in github.com/prometheus/client_golangGO-2022-0969 Denial of service in net/http and golang.org/x/net/http2GO-2022-1144 Excessive memory growth in net/http and golang.org/x/net/http2GO-2023-1571 Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/netGO-2023-1988 Improper rendering of text nodes in golang.org/x/net/htmlGO-2023-2102 HTTP/2 rapid reset can cause excessive work in net/httpGO-2024-2687 HTTP/2 CONTINUATION flood in net/httpGO-2025-3503 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/netGO-2025-3595 Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/netGO-2026-5028 Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/htmlGHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation AttackGO-2022-0493 Incorrect privilege reporting in syscall and golang.org/x/sys/unixGO-2023-2153 Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpcGO-2026-6061 Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpcGO-2024-2611 Infinite loop in JSON unmarshaling in google.golang.org/protobufCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.