gitsafehub
github.com/nearai/ironclaw-e2e-test ↗

nearai/ironclaw-e2e-test

scanned 2026-08-06 · git 07972fc
2 of 6 checks flagged a security issue
🟡 Worth a look
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets—Vulnerable dependencies30Known OSS vulnerabilities63Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 120s

Vulnerable dependencies — Trivyⓘ 30 found

Packages you depend on that have known security holes (CVEs).

  • Worth fixing CVE-2026-25537 jsonwebtoken: jsonwebtoken has Type Confusion that leads to potential authorization bypass
    Cargo.lock
    A package you depend on has a known security hole (CVE-2026-25537). Fix: Update that package to its patched version.
  • Worth fixing GHSA-36hh-v3qg-5jq4 PyO3 has an Out-of-bounds Read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators
    Cargo.lock
    A package you depend on has a known security hole (GHSA-36hh-v3qg-5jq4). Fix: Update that package to its patched version.
  • Worth fixing GHSA-chgr-c6px-7xpp PyO3 has a missing `Sync` bound on `PyCFunction::new_closure` closures
    Cargo.lock
    A package you depend on has a known security hole (GHSA-chgr-c6px-7xpp). Fix: Update that package to its patched version.
  • Worth fixing GHSA-4w2j-m93h-cj5j Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly
    Cargo.lock
    A package you depend on has a known security hole (GHSA-4w2j-m93h-cj5j). Fix: Update that package to its patched version.
  • Worth fixing GHSA-82j2-j2ch-gfr8 rustls-webpki: Denial of service via panic on malformed CRL BIT STRING
    Cargo.lock
    A package you depend on has a known security hole (GHSA-82j2-j2ch-gfr8). Fix: Update that package to its patched version.
  • Worth fixing GHSA-82j2-j2ch-gfr8 rustls-webpki: Denial of service via panic on malformed CRL BIT STRING
    Cargo.lock
    A package you depend on has a known security hole (GHSA-82j2-j2ch-gfr8). Fix: Update that package to its patched version.
  • Worth fixing GHSA-pwjx-qhcg-rvj4 webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic
    Cargo.lock
    A package you depend on has a known security hole (GHSA-pwjx-qhcg-rvj4). Fix: Update that package to its patched version.
  • Worth fixing GHSA-82j2-j2ch-gfr8 rustls-webpki: Denial of service via panic on malformed CRL BIT STRING
    Cargo.lock
    A package you depend on has a known security hole (GHSA-82j2-j2ch-gfr8). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7gcf-g7xr-8hxj serde_with: KeyValueMap serialization panics on empty sequence or map entries
    Cargo.lock
    A package you depend on has a known security hole (GHSA-7gcf-g7xr-8hxj). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3pv8-6f4r-ffg2 tar has a PAX header desynchronization issue
    Cargo.lock
    A package you depend on has a known security hole (GHSA-3pv8-6f4r-ffg2). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44216 wasmtime: Wasmtime: Denial of Service via large WebAssembly table allocation
    Cargo.lock
    A package you depend on has a known security hole (CVE-2026-44216). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-47261 wasmtime-wasi: Wasmtime: Wasmtime: Access control bypass allows unauthorized file truncation via specific open flags.
    Cargo.lock
    A package you depend on has a known security hole (CVE-2026-47261). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-13676 fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization
    docs/architecture-video/package-lock.json
    A package you depend on has a known security hole (CVE-2026-13676). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-16221 Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x ...
    docs/architecture-video/package-lock.json
    A package you depend on has a known security hole (CVE-2026-16221). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-18446 fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority
    docs/architecture-video/package-lock.json
    A package you depend on has a known security hole (CVE-2026-18446). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-6321 fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies
    docs/architecture-video/package-lock.json
    A package you depend on has a known security hole (CVE-2026-6321). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-6322 fast-uri: fast-uri: URI authority bypass due to improper delimiter handling
    docs/architecture-video/package-lock.json
    A package you depend on has a known security hole (CVE-2026-6322). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-45623 postcss: PostCSS: Information disclosure and denial of service via crafted CSS input
    docs/architecture-video/package-lock.json
    A package you depend on has a known security hole (CVE-2026-45623). Fix: Update that package to its patched version.
  • Worth fixing GHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
    docs/architecture-video/package-lock.json
    A package you depend on has a known security hole (GHSA-r28c-9q8g-f849). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-41305 postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags
    docs/architecture-video/package-lock.json
    A package you depend on has a known security hole (CVE-2026-41305). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-69153 postcss: PostCSS: Information disclosure via crafted sourceMappingURL
    docs/architecture-video/package-lock.json
    A package you depend on has a known security hole (CVE-2026-69153). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-48779 ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments
    docs/architecture-video/package-lock.json
    A package you depend on has a known security hole (CVE-2026-48779). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-45736 ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`
    docs/architecture-video/package-lock.json
    A package you depend on has a known security hole (CVE-2026-45736). Fix: Update that package to its patched version.
  • Minor GHSA-rhfx-m35p-ff5j `IterMut` violates Stacked Borrows by invalidating internal pointer
    Cargo.lock
    A package you depend on has a known security hole (GHSA-rhfx-m35p-ff5j). Fix: Update that package to its patched version.
  • Minor GHSA-cq8v-f236-94qc Rand is unsound with a custom logger using rand::rng()
    Cargo.lock
    A package you depend on has a known security hole (GHSA-cq8v-f236-94qc). Fix: Update that package to its patched version.
… 5 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 63 found

Your dependencies cross-checked against the OSV vulnerability database.

  • Worth fixing GHSA-h395-gr6q-cpjc jsonwebtoken has Type Confusion that leads to potential authorization bypass
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-25537). Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2025-0067 `libyml::string::yaml_string_extend` is unsound and unmaintained
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0187 Stack overflow in lopdf via deeply nested PDF objects
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0179 Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0180 Panic decoding a malformed `hstore` value allows denial of service
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0176 Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0177 Missing `Sync` bound on `PyCFunction::new_closure` closures
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0185 Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-25800). Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0104 Reachable panic in certificate revocation list parsing
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0049 CRLs not considered authoritative by Distribution Point due to faulty matching logic
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0104 Reachable panic in certificate revocation list parsing
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0104 Reachable panic in certificate revocation list parsing
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-7gcf-g7xr-8hxj serde_with: KeyValueMap serialization panics on empty sequence or map entries
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2025-0068 serde_yml crate is unsound and unmaintained
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0178 Panic on a `DataRow` with fewer fields than columns allows denial of service
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/Cargo.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2025-0111 `tokio-tar` parses PAX extended headers incorrectly, allows file smuggling
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/Cargo.lock
    A package you depend on has a known security hole (CVE-2025-62518). Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0114 Panic when allocating a table exceeding the size of the host's address space
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-44216). Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0149 WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-47261). Fix: Update that package to its patched version.
  • Worth fixing RUSTSEC-2026-0188 WASI hard links and renames bypass wasmtime-wasi's FilePerms for destination
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/Cargo.lock
    A package you depend on has a known security hole (CVE-2026-58494). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/docs/architecture-video/package-lock.json
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/docs/architecture-video/package-lock.json
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/docs/architecture-video/package-lock.json
    A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/docs/architecture-video/package-lock.json
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/docs/architecture-video/package-lock.json
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
    /workdirs/scan-0bbeee86-1eda-4da7-bb24-ff7fd788d846/docs/architecture-video/package-lock.json
    A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
… 38 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.