syndbg/homebrew

API keys, passwords or tokens committed into the repo.

• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:24
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:29
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:34
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:39
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:44
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:49
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:54
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:59
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:64
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:69
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:74
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:79
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:84
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:89
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:94
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:99
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:104
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:109
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:114
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:119
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:124
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:129
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:134
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:139
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious sourcegraph-access-token Sourcegraph is a code search and navigation engine.
  Library/Formula/srclib.rb:144
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2015-1820 rubygem-rest-client: session fixation vulnerability Set-Cookie headers present in an HTTP 30x redirection responses
  Library/Homebrew/test/Gemfile.lock
  A package you depend on has a known security hole (CVE-2015-1820). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-10663 rubygem-json: Unsafe object creation vulnerability in JSON
  Library/Homebrew/test/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-10663). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-8130 rake: OS Command Injection via egrep in Rake::FileList
  Library/Homebrew/test/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8130). Fix: Update that package to its patched version.
• Minor CVE-2015-3448 rubygem-rest-client: unsanitized application logging
  Library/Homebrew/test/Gemfile.lock
  A package you depend on has a known security hole (CVE-2015-3448). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GHSA-3fhf-6939-qg8p rest-client Gem Vulnerable to Session Fixation
  /workdirs/scan-4ac2ca6b-b221-4ade-ba77-03861a05cfaf/Library/Homebrew/test/Gemfile.lock
  A package you depend on has a known security hole (CVE-2015-1820). Fix: Update that package to its patched version.
• Worth fixing GHSA-jphg-qwrw-7w9g Unsafe object creation in json RubyGem
  /workdirs/scan-4ac2ca6b-b221-4ade-ba77-03861a05cfaf/Library/Homebrew/test/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-10663). Fix: Update that package to its patched version.
• Worth fixing GHSA-jppv-gw3r-w3q8 OS Command Injection in Rake
  /workdirs/scan-4ac2ca6b-b221-4ade-ba77-03861a05cfaf/Library/Homebrew/test/Gemfile.lock
  A package you depend on has a known security hole (CVE-2020-8130). Fix: Update that package to its patched version.
• Minor GHSA-mx9f-w8qq-q5jf rest-client allows local users to obtain sensitive information by reading the log
  /workdirs/scan-4ac2ca6b-b221-4ade-ba77-03861a05cfaf/Library/Homebrew/test/Gemfile.lock
  A package you depend on has a known security hole (CVE-2015-3448). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0