github.com/mxschmitt/playwrighttestgithub ↗

mxschmitt/playwrighttestgithub

scanned 2026-08-10 · git af85ef1

3 of 6 checks flagged a security issue

🔴 Needs attention

Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets5Vulnerable dependencies2Known OSS vulnerabilities11Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ 5 found

API keys, passwords or tokens committed into the repo.

Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

src/XUnitTestProject/bin/Debug/.playwright/package/lib/server/android/android.js:406

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

src/XUnitTestProject/bin/Debug/.playwright/package/lib/server/registry/nativeDeps.js:126

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

src/XUnitTestProject/bin/Debug/.playwright/package/lib/server/registry/nativeDeps.js:222

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

src/XUnitTestProject/bin/Debug/.playwright/package/lib/server/registry/nativeDeps.js:317

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

src/XUnitTestProject/bin/Debug/.playwright/package/lib/webpack/traceViewer/assets/xtermModule-0fb1e5c9.js:7

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 2 found

Packages you depend on that have known security holes (CVEs).

Worth fixing CVE-2024-30105 dotnet: DoS in System.Text.Json

src/XUnitTestProject/bin/Debug/Microsoft.Playwright.deps.json

A package you depend on has a known security hole (CVE-2024-30105). Fix: Update that package to its patched version.
Worth fixing CVE-2024-30105 dotnet: DoS in System.Text.Json

src/XUnitTestProject/packages.config

A package you depend on has a known security hole (CVE-2024-30105). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 11 found · 1 serious

Your dependencies cross-checked against the OSV vulnerability database.

Serious GHSA-m7jm-9gc2-mpf2 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

/workdirs/scan-5930039f-8d13-4b18-b91a-683ee37c2a88/src/Playwright.TestingHarnessTest/package-lock.json

A package you depend on has a known security hole (CVE-2026-25896). Fix: Update that package to its patched version.
Worth fixing GHSA-6w63-h3fj-q4vw fast-xml-parser vulnerable to Regex Injection via Doctype Entities

/workdirs/scan-5930039f-8d13-4b18-b91a-683ee37c2a88/src/Playwright.TestingHarnessTest/package-lock.json

A package you depend on has a known security hole (CVE-2023-34104). Fix: Update that package to its patched version.
Worth fixing GHSA-8gc5-j5rx-235r fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)

/workdirs/scan-5930039f-8d13-4b18-b91a-683ee37c2a88/src/Playwright.TestingHarnessTest/package-lock.json

A package you depend on has a known security hole (CVE-2026-33036). Fix: Update that package to its patched version.
Worth fixing GHSA-gh4j-gqv2-49f6 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

/workdirs/scan-5930039f-8d13-4b18-b91a-683ee37c2a88/src/Playwright.TestingHarnessTest/package-lock.json

A package you depend on has a known security hole (CVE-2026-41650). Fix: Update that package to its patched version.
Worth fixing GHSA-jmr7-xgp7-cmfj fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)

/workdirs/scan-5930039f-8d13-4b18-b91a-683ee37c2a88/src/Playwright.TestingHarnessTest/package-lock.json

A package you depend on has a known security hole (CVE-2026-26278). Fix: Update that package to its patched version.
Worth fixing GHSA-jp2q-39xq-3w4g Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser

/workdirs/scan-5930039f-8d13-4b18-b91a-683ee37c2a88/src/Playwright.TestingHarnessTest/package-lock.json

A package you depend on has a known security hole (CVE-2026-33349). Fix: Update that package to its patched version.
Worth fixing GHSA-cxjh-pqwp-8mfp follow-redirects' Proxy-Authorization header kept across hosts

/workdirs/scan-5930039f-8d13-4b18-b91a-683ee37c2a88/src/Playwright.TestingHarnessTest/package-lock.json

A package you depend on has a known security hole (CVE-2024-28849). Fix: Update that package to its patched version.
Worth fixing GHSA-jchw-25xp-jwwc Follow Redirects improperly handles URLs in the url.parse() function

/workdirs/scan-5930039f-8d13-4b18-b91a-683ee37c2a88/src/Playwright.TestingHarnessTest/package-lock.json

A package you depend on has a known security hole (CVE-2023-26159). Fix: Update that package to its patched version.
Worth fixing GHSA-r4q5-vmmm-2653 follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

/workdirs/scan-5930039f-8d13-4b18-b91a-683ee37c2a88/src/Playwright.TestingHarnessTest/package-lock.json

A package you depend on has a known security hole (CVE-2026-40895). Fix: Update that package to its patched version.
Worth fixing GHSA-hh2w-p6rv-4g7w Microsoft Security Advisory CVE-2024-30105 | .NET Denial of Service Vulnerability

/workdirs/scan-5930039f-8d13-4b18-b91a-683ee37c2a88/src/XUnitTestProject/packages.config

A package you depend on has a known security hole (CVE-2024-30105). Fix: Update that package to its patched version.
Minor GHSA-fj3w-jwp8-x2g3 fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

/workdirs/scan-5930039f-8d13-4b18-b91a-683ee37c2a88/src/Playwright.TestingHarnessTest/package-lock.json

A package you depend on has a known security hole (CVE-2026-27942). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.