gitsafehub
github.com/stevenacoffman/agentic-dev-harness ↗

stevenacoffman/agentic-dev-harness

scanned 2026-08-13 · git 1400b66
3 of 6 checks flagged a security issue
🔴 Needs attention
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets1Vulnerable dependencies3Known OSS vulnerabilities10Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ 1 found · 1 serious

API keys, passwords or tokens committed into the repo.

  • Serious github-pat Uncovered a GitHub Personal Access Token, potentially leading to unauthorized repository access and sensitive content exposure.
    internal/redact/redact_test.go:24
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 3 found

Packages you depend on that have known security holes (CVEs).

  • Worth fixing CVE-2026-71556 go-git is an extensible git implementation library written in pure Go. ...
    go.mod
    A package you depend on has a known security hole (CVE-2026-71556). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-71557 go-git is an extensible git implementation library written in pure Go. ...
    go.mod
    A package you depend on has a known security hole (CVE-2026-71557). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-46600 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
    go.mod
    A package you depend on has a known security hole (CVE-2026-46600). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 10 found

Your dependencies cross-checked against the OSV vulnerability database.

  • Worth fixing GHSA-hc8v-wwc9-vgxm go-git: Worktree operations may follow symlinks
    /workdirs/scan-ad38dcbc-5754-468f-a6ba-388658e7fa1b/go.mod
    A package you depend on has a known security hole (CVE-2026-71556). Fix: Update that package to its patched version.
  • Worth fixing GHSA-qgq7-7hm3-q39j go-git: Malicious reference names may modify files outside the reference storage
    /workdirs/scan-ad38dcbc-5754-468f-a6ba-388658e7fa1b/go.mod
    A package you depend on has a known security hole (CVE-2026-71557). Fix: Update that package to its patched version.
  • FYI GO-2026-5841 OOB read in github.com/klauspost/compress/s2
    /workdirs/scan-ad38dcbc-5754-468f-a6ba-388658e7fa1b/go.mod
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • FYI GO-2026-5932 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
    /workdirs/scan-ad38dcbc-5754-468f-a6ba-388658e7fa1b/go.mod
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • FYI GO-2026-5942 Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
    /workdirs/scan-ad38dcbc-5754-468f-a6ba-388658e7fa1b/go.mod
    A package you depend on has a known security hole (CVE-2026-46600). Fix: Update that package to its patched version.
  • FYI GO-2026-4970 Root escape via symlink plus trailing slash in os
    /workdirs/scan-ad38dcbc-5754-468f-a6ba-388658e7fa1b/go.mod
    A package you depend on has a known security hole (CVE-2026-39822). Fix: Update that package to its patched version.
  • FYI GO-2026-5037 Inefficient candidate hostname parsing in crypto/x509
    /workdirs/scan-ad38dcbc-5754-468f-a6ba-388658e7fa1b/go.mod
    A package you depend on has a known security hole (CVE-2026-27145). Fix: Update that package to its patched version.
  • FYI GO-2026-5038 Quadratic complexity in WordDecoder.DecodeHeader in mime
    /workdirs/scan-ad38dcbc-5754-468f-a6ba-388658e7fa1b/go.mod
    A package you depend on has a known security hole (CVE-2026-42504). Fix: Update that package to its patched version.
  • FYI GO-2026-5039 Arbitrary inputs are included in errors without any escaping in net/textproto
    /workdirs/scan-ad38dcbc-5754-468f-a6ba-388658e7fa1b/go.mod
    A package you depend on has a known security hole (CVE-2026-42507). Fix: Update that package to its patched version.
  • FYI GO-2026-5856 Invoking Encrypted Client Hello privacy leak in crypto/tls
    /workdirs/scan-ad38dcbc-5754-468f-a6ba-388658e7fa1b/go.mod
    A package you depend on has a known security hole (CVE-2026-42505). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: go:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.