railsware/gdoc_pivotal

API keys, passwords or tokens committed into the repo.

• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  javascripts/gdoc_pivotal_background.js:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  javascripts/gdoc_pivotal_background.js:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  javascripts/gdoc_pivotal_background.js:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  assets/javascripts/gdoc_pivotal_background.coffee:38
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  javascripts/gdoc_pivotal_background.js:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  javascripts/gdoc_pivotal_background.js:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  javascripts/gdoc_pivotal_background.js:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  javascripts/gdoc_pivotal_background.js:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  javascripts/gdoc_pivotal_background.js:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  javascripts/gdoc_pivotal_background.js:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  javascripts/gdoc_pivotal_background.js:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  javascripts/gdoc_pivotal_background.js:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  javascripts/gdoc_pivotal_background.js:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  background.html:23
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  javascripts/gdoc_pivotal_background.js:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  assets/javascripts/gdoc_pivotal_background.coffee:21
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2013-0156 rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-0156). Fix: Update that package to its patched version.
• Serious CVE-2020-8165 rubygem-activesupport: potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8165). Fix: Update that package to its patched version.
• Serious CVE-2022-30123 rubygem-rack: crafted requests can cause shell escape sequences
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-30123). Fix: Update that package to its patched version.
• Serious CVE-2015-8857 The uglify-js package before 2.4.24 for Node.js does not properly acco ...
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2015-8857). Fix: Update that package to its patched version.
• Worth fixing CVE-2012-2660 rubygem-actionpack: Unsafe query generation
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2012-2660). Fix: Update that package to its patched version.
• Worth fixing CVE-2014-0130 rubygem-actionpack: directory traversal issue
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2014-0130). Fix: Update that package to its patched version.
• Worth fixing CVE-2016-0751 rubygem-actionpack: possible object leak and denial of service attack in Action Pack
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-0751). Fix: Update that package to its patched version.
• Worth fixing CVE-2016-0752 rubygem-actionpack: directory traversal flaw in Action View
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-0752). Fix: Update that package to its patched version.
• Worth fixing CVE-2016-2098 rubygem-actionpack: code injection vulnerability in Action View
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-2098). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-22795 rubygem-actionpack: Denial of Service in Action Dispatch
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-22795). Fix: Update that package to its patched version.
• Worth fixing CVE-2011-0446 Multiple cross-site scripting (XSS) vulnerabilities in the mail_to hel ...
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2011-0446). Fix: Update that package to its patched version.
• Worth fixing CVE-2011-1497 rubygem-actionpack: Cross-site scripting in auto_link function
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2011-1497). Fix: Update that package to its patched version.
• Worth fixing CVE-2011-2197 Potential XSS Vulnerability in Ruby on Rails Applications
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2011-2197). Fix: Update that package to its patched version.
• Worth fixing CVE-2011-3186 CRLF injection vulnerability in actionpack/lib/action_controller/respo ...
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2011-3186). Fix: Update that package to its patched version.
• Worth fixing CVE-2012-1099 rubygem-actionpack: XSS in the 'select' helper
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2012-1099). Fix: Update that package to its patched version.
• Worth fixing CVE-2012-2694 rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660)
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2012-2694). Fix: Update that package to its patched version.
• Worth fixing CVE-2012-3424 rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2012-3424). Fix: Update that package to its patched version.
• Worth fixing CVE-2012-3463 rubygem-actionpack: potential XSS vulnerability in select_tag prompt
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2012-3463). Fix: Update that package to its patched version.
• Worth fixing CVE-2012-3465 rubygem-actionpack: XSS Vulnerability in strip_tags
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2012-3465). Fix: Update that package to its patched version.
• Worth fixing CVE-2013-1855 rubygem-actionpack: css_sanitization: XSS vulnerability in sanitize_css
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-1855). Fix: Update that package to its patched version.
• Worth fixing CVE-2013-1857 rubygem-actionpack: sanitize_protocol: XSS Vulnerability in the helper of Ruby on Rails
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-1857). Fix: Update that package to its patched version.
• Worth fixing CVE-2013-4491 rubygem-actionpack: i18n missing translation XSS
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-4491). Fix: Update that package to its patched version.
• Worth fixing CVE-2013-6414 rubygem-actionpack: Action View DoS
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-6414). Fix: Update that package to its patched version.
• Worth fixing CVE-2013-6415 rubygem-actionpack: number_to_currency XSS
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-6415). Fix: Update that package to its patched version.
• Worth fixing CVE-2013-6416 rubygem-actionpack: simple_format XSS
  Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-6416). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-wq4h-7r42-5hrr Possible shell escape sequence injection vulnerability in Rack
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2022-30123). Fix: Update that package to its patched version.
• Serious GHSA-34r7-q49f-h37c Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2015-8857). Fix: Update that package to its patched version.
• Worth fixing GHSA-4g8v-vg43-wpgf Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-28362). Fix: Update that package to its patched version.
• Worth fixing GHSA-ffpv-c4hm-3x6v actionpack is vulnerable to denial of service via a crafted HTTP Accept header
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-0751). Fix: Update that package to its patched version.
• Worth fixing GHSA-jmgw-6vjg-jjwg actionpack Improper Input Validation vulnerability
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2013-0156). Fix: Update that package to its patched version.
• Worth fixing GHSA-xrr4-p6fq-hjg7 Directory traversal vulnerability in Action View in Ruby on Rails
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2016-0752). Fix: Update that package to its patched version.
• Worth fixing GHSA-2j26-frm8-cmj9 Rails Active Support has a possible DoS vulnerability in its number helpers
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33176). Fix: Update that package to its patched version.
• Worth fixing GHSA-89vf-4333-qx8v Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33170). Fix: Update that package to its patched version.
• Worth fixing GHSA-cg4j-q9v8-6v38 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-33169). Fix: Update that package to its patched version.
• Worth fixing GHSA-pj73-v5mw-pm9j Possible XSS Security Vulnerability in SafeBuffer#bytesplice
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-28120). Fix: Update that package to its patched version.
• Worth fixing GHSA-2gw2-8q9w-cw8p Ruby-ffi has a DLL loading issue
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2018-1000201). Fix: Update that package to its patched version.
• Worth fixing GHSA-34hf-g744-jw64 i18n Vulnerable to Denial of Service Attack
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2014-10077). Fix: Update that package to its patched version.
• Worth fixing GHSA-22f2-v57c-j9cx Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2024-25126). Fix: Update that package to its patched version.
• Worth fixing GHSA-3h57-hmj3-gj3p Rack has possible DoS Vulnerability in Multipart MIME parsing
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2023-27530). Fix: Update that package to its patched version.
• Worth fixing GHSA-5f9h-9pjv-v6j7 Directory traversal in Rack::Directory app bundled with Rack
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8161). Fix: Update that package to its patched version.
• Worth fixing GHSA-5r2p-j47h-mhpg Rack vulnerable to Cross-site Scripting
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2018-16471). Fix: Update that package to its patched version.
• Worth fixing GHSA-625h-95r8-8xpm Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-59830). Fix: Update that package to its patched version.
• Worth fixing GHSA-6xw4-3v39-52mm Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-61919). Fix: Update that package to its patched version.
• Worth fixing GHSA-7g2v-jj9q-g3rg Possible Log Injection in Rack::CommonLogger
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-25184). Fix: Update that package to its patched version.
• Worth fixing GHSA-7mqq-6cf9-v2qp Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-34763). Fix: Update that package to its patched version.
• Worth fixing GHSA-7wqh-767x-r66v Local File Inclusion in Rack::Static
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-27610). Fix: Update that package to its patched version.
• Worth fixing GHSA-8cgq-6mh2-7j6v Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-27111). Fix: Update that package to its patched version.
• Worth fixing GHSA-8vqr-qjwx-82mw Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-34829). Fix: Update that package to its patched version.
• Worth fixing GHSA-gjh7-p2fx-99vx Rack has an Unbounded-Parameter DoS in Rack::QueryParser
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2025-46727). Fix: Update that package to its patched version.
• Worth fixing GHSA-h2jq-g4cq-5ppq Rack::Static prefix matching can expose unintended files under the static root
  /workdirs/scan-9b2ec4a3-eb9d-403b-aa4e-f356ec6cee15/Gemfile.lock
  A package you depend on has a known security hole (CVE-2026-34785). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0