provablehq/sdk

API keys, passwords or tokens committed into the repo.

• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  wasm/src/programs/program.rs:93
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  wasm/src/programs/program.rs:148
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  create-leo-app/template-devnode-js/index.js:38
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  create-leo-app/template-node-dynamic-dispatch-proving-ts/src/index.ts:39
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  create-leo-app/template-node-ts/src/index.ts:34
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  create-leo-app/template-react-ts/src/App.tsx:9
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  sdk/tests/account.test.ts:133
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  sdk/tests/account.test.ts:154
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  sdk/tests/account.test.ts:169
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  sdk/tests/data/account-data.ts:8
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  sdk/tests/data/account-data.ts:9
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  sdk/tests/data/account-data.ts:12
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  sdk/tests/data/account-data.ts:38
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  sdk/tests/external-signing.test.ts:441
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  sdk/tests/transport-e2e.mjs:42
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  sdk/tests/record-scanner.test.ts:27
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  wasm/src/account/view_key.rs:182
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  sdk/tests/wasm.test.ts:359
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  create-leo-app/template-devnode-js/index.js:38
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  create-leo-app/template-node-dynamic-dispatch-proving-ts/src/index.ts:39
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  create-leo-app/template-node-ts/src/index.ts:34
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  create-leo-app/template-react-ts/src/App.tsx:9
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  sdk/tests/account.test.ts:133
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  sdk/tests/account.test.ts:154
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  sdk/tests/account.test.ts:169
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Worth fixing GHSA-394x-vwmw-crm3 AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN
  wasm/Cargo.lock
  A package you depend on has a known security hole (GHSA-394x-vwmw-crm3). Fix: Update that package to its patched version.
• Worth fixing GHSA-65p9-r9h6-22vj AWS-LC has Timing Side-Channel in AES-CCM Tag Verification
  wasm/Cargo.lock
  A package you depend on has a known security hole (GHSA-65p9-r9h6-22vj). Fix: Update that package to its patched version.
• Worth fixing GHSA-9f94-5g5w-gf6r CRL Distribution Point Scope Check Logic Error in AWS-LC
  wasm/Cargo.lock
  A package you depend on has a known security hole (GHSA-9f94-5g5w-gf6r). Fix: Update that package to its patched version.
• Worth fixing GHSA-hfpc-8r3f-gw53 AWS-LC has PKCS7_verify Signature Validation Bypass
  wasm/Cargo.lock
  A package you depend on has a known security hole (GHSA-hfpc-8r3f-gw53). Fix: Update that package to its patched version.
• Worth fixing GHSA-vw5v-4f2q-w9xf AWS-LC has PKCS7_verify Certificate Chain Validation Bypass
  wasm/Cargo.lock
  A package you depend on has a known security hole (GHSA-vw5v-4f2q-w9xf). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-25547 brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-25547). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-69873 ajv: ReDoS via $data reference
  yarn.lock
  A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-14257 brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-69152 brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-14257 brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-69152 brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-18446 fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-18446). Fix: Update that package to its patched version.
• Worth fixing GHSA-5p4m-2wfm-xmqj JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
  yarn.lock
  A package you depend on has a known security hole (GHSA-5p4m-2wfm-xmqj). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-26996 minimatch: minimatch: Denial of Service via specially crafted glob patterns
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-26996). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-27903 minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-27903). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-27904 minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-27904). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-26996 minimatch: minimatch: Denial of Service via specially crafted glob patterns
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-26996). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-27903 minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-27903). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-27904 minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-27904). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-26996 minimatch: minimatch: Denial of Service via specially crafted glob patterns
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-26996). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-27903 minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-27903). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-27904 minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-27904). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2026-0044 AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/wasm/Cargo.lock
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2026-0045 Timing Side-Channel in AES-CCM Tag Verification in AWS-LC
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/wasm/Cargo.lock
  A package you depend on has a known security hole (CVE-2026-3337). Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2026-0046 PKCS7_verify Certificate Chain Validation Bypass in AWS-LC
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/wasm/Cargo.lock
  A package you depend on has a known security hole (CVE-2026-3336). Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2026-0047 PKCS7_verify Signature Validation Bypass in AWS-LC
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/wasm/Cargo.lock
  A package you depend on has a known security hole (CVE-2026-3338). Fix: Update that package to its patched version.
• Worth fixing RUSTSEC-2026-0048 CRL Distribution Point Scope Check Logic Error in AWS-LC
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/wasm/Cargo.lock
  A package you depend on has a known security hole (CVE-2026-4428). Fix: Update that package to its patched version.
• Worth fixing GHSA-7h2j-956f-4vf2 @isaacs/brace-expansion has Uncontrolled Resource Consumption
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2026-25547). Fix: Update that package to its patched version.
• Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
• Worth fixing GHSA-3g43-6gmg-66jw axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2026-44495). Fix: Update that package to its patched version.
• Worth fixing GHSA-3p68-rc4w-qgx5 Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2025-62718). Fix: Update that package to its patched version.
• Worth fixing GHSA-43fc-jf86-j433 Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2026-25639). Fix: Update that package to its patched version.
• Worth fixing GHSA-5c9x-8gcm-mpgx Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2026-42034). Fix: Update that package to its patched version.
• Worth fixing GHSA-62hf-57xw-28j9 Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2026-42039). Fix: Update that package to its patched version.
• Worth fixing GHSA-6chq-wfr3-2hj9 Axios: Header Injection via Prototype Pollution
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2026-42035). Fix: Update that package to its patched version.
• Worth fixing GHSA-7q8q-rj6j-mhjq Axios: Nested axios option objects can consume polluted prototype values
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2026-67319). Fix: Update that package to its patched version.
• Worth fixing GHSA-898c-q2cr-xwhg axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2026-44490). Fix: Update that package to its patched version.
• Worth fixing GHSA-fvcv-3m26-pcqx Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2026-40175). Fix: Update that package to its patched version.
• Worth fixing GHSA-hfxv-24rg-xrqf Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2026-44496). Fix: Update that package to its patched version.
• Worth fixing GHSA-j5f8-grm9-p9fc Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2026-44486). Fix: Update that package to its patched version.
• Worth fixing GHSA-jr5f-v2jv-69x6 axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2025-27152). Fix: Update that package to its patched version.
• Worth fixing GHSA-m7pr-hjqh-92cm Axios: no_proxy bypass via IP alias allows SSRF
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2026-42038). Fix: Update that package to its patched version.
• Worth fixing GHSA-mmx7-hfxf-jppx Axios: Prototype pollution gadgets can alter axios request construction
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2026-67316). Fix: Update that package to its patched version.
• Worth fixing GHSA-p92q-9vqr-4j8v Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
  /workdirs/scan-1722ffc5-a58d-4c39-bf8f-dbc66d90d9f8/yarn.lock
  A package you depend on has a known security hole (CVE-2026-44487). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout