shawntabrizi/substrate-known-keys

API keys, passwords or tokens committed into the repo.

• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  dictionary.json:5
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  dictionary.json:9
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:28
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:416
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:420
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:424
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:428
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:432
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:436
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:580
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:552
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:952
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:1280
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:1284
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:1288
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:1548
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:1828
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:1924
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:1928
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:1940
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:52
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:56
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:60
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:64
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  known-keys.json:68
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Worth fixing CVE-2026-2739 bn.js: bn.js: Denial of Service via calling maskn(0)
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-2739). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-37890 nodejs-ws: denial of service when handling a request with many HTTP headers
  yarn.lock
  A package you depend on has a known security hole (CVE-2024-37890). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-48779 ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-48779). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-45736 ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`
  yarn.lock
  A package you depend on has a known security hole (CVE-2026-45736). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Worth fixing GHSA-378v-28hj-76wf bn.js affected by an infinite loop
  /workdirs/scan-fa88fef1-4ccc-4cb0-ad10-6a1fdc128cc6/yarn.lock
  A package you depend on has a known security hole (CVE-2026-2739). Fix: Update that package to its patched version.
• Worth fixing GHSA-3h5v-q93c-6h6q ws affected by a DoS when handling a request with many HTTP headers
  /workdirs/scan-fa88fef1-4ccc-4cb0-ad10-6a1fdc128cc6/yarn.lock
  A package you depend on has a known security hole (CVE-2024-37890). Fix: Update that package to its patched version.
• Worth fixing GHSA-58qx-3vcg-4xpx ws: Uninitialized memory disclosure
  /workdirs/scan-fa88fef1-4ccc-4cb0-ad10-6a1fdc128cc6/yarn.lock
  A package you depend on has a known security hole (CVE-2026-45736). Fix: Update that package to its patched version.
• Worth fixing GHSA-96hv-2xvq-fx4p ws: Memory exhaustion DoS from tiny fragments and data chunks
  /workdirs/scan-fa88fef1-4ccc-4cb0-ad10-6a1fdc128cc6/yarn.lock
  A package you depend on has a known security hole (CVE-2026-48779). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout