tlvince/zedless

scanned 2026-08-14 · git 6914bc3

2 of 6 checks flagged a security issue

🔴 Needs attention

Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets—Vulnerable dependencies103Known OSS vulnerabilities162Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 120s

Vulnerable dependencies — Trivyⓘ 103 found · 2 serious

Packages you depend on that have known security holes (CVEs).

Serious CVE-2026-34987 wasmtime: bytecodealliance/wasmtime: Wasmtime: Arbitrary code execution via incorrect memory offset handling in Winch compiler

Cargo.lock

A package you depend on has a known security hole (CVE-2026-34987). Fix: Update that package to its patched version.
Serious CVE-2025-7783 form-data: Unsafe random function in form-data

script/issue_response/pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
Worth fixing CVE-2026-53600 async-tar PAX extension-header desync enables tar entry/content smuggling

Cargo.lock

A package you depend on has a known security hole (CVE-2026-53600). Fix: Update that package to its patched version.
Worth fixing GHSA-65p9-r9h6-22vj AWS-LC has Timing Side-Channel in AES-CCM Tag Verification

Cargo.lock

A package you depend on has a known security hole (GHSA-65p9-r9h6-22vj). Fix: Update that package to its patched version.
Worth fixing GHSA-9f94-5g5w-gf6r CRL Distribution Point Scope Check Logic Error in AWS-LC

Cargo.lock

A package you depend on has a known security hole (GHSA-9f94-5g5w-gf6r). Fix: Update that package to its patched version.
Worth fixing GHSA-hfpc-8r3f-gw53 AWS-LC has PKCS7_verify Signature Validation Bypass

Cargo.lock

A package you depend on has a known security hole (GHSA-hfpc-8r3f-gw53). Fix: Update that package to its patched version.
Worth fixing GHSA-vw5v-4f2q-w9xf AWS-LC has PKCS7_verify Certificate Chain Validation Bypass

Cargo.lock

A package you depend on has a known security hole (GHSA-vw5v-4f2q-w9xf). Fix: Update that package to its patched version.
Worth fixing CVE-2026-25541 Bytes is a utility library for working with bytes. From version 1.2.1 ...

Cargo.lock

A package you depend on has a known security hole (CVE-2026-25541). Fix: Update that package to its patched version.
Worth fixing CVE-2026-42199 Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior

Cargo.lock

A package you depend on has a known security hole (CVE-2026-42199). Fix: Update that package to its patched version.
Worth fixing CVE-2026-41676 rust-openssl provides OpenSSL bindings for the Rust programming langua ...

Cargo.lock

A package you depend on has a known security hole (CVE-2026-41676). Fix: Update that package to its patched version.
Worth fixing CVE-2026-41678 rust-openssl provides OpenSSL bindings for the Rust programming langua ...

Cargo.lock

A package you depend on has a known security hole (CVE-2026-41678). Fix: Update that package to its patched version.
Worth fixing CVE-2026-41681 rust-openssl provides OpenSSL bindings for the Rust programming langua ...

Cargo.lock

A package you depend on has a known security hole (CVE-2026-41681). Fix: Update that package to its patched version.
Worth fixing CVE-2026-41898 rust-openssl provides OpenSSL bindings for the Rust programming langua ...

Cargo.lock

A package you depend on has a known security hole (CVE-2026-41898). Fix: Update that package to its patched version.
Worth fixing CVE-2026-42327 rust-openssl: rust-openssl: Arbitrary code execution via specially crafted certificate

Cargo.lock

A package you depend on has a known security hole (CVE-2026-42327). Fix: Update that package to its patched version.
Worth fixing CVE-2026-44662 rust-openssl provides OpenSSL bindings for the Rust programming langua ...

Cargo.lock

A package you depend on has a known security hole (CVE-2026-44662). Fix: Update that package to its patched version.
Worth fixing CVE-2026-45784 rust-openssl: rust-openssl: Heap Corruption from Incorrect Buffer Sizing

Cargo.lock

A package you depend on has a known security hole (CVE-2026-45784). Fix: Update that package to its patched version.
Worth fixing GHSA-82j2-j2ch-gfr8 rustls-webpki: Denial of service via panic on malformed CRL BIT STRING

Cargo.lock

A package you depend on has a known security hole (GHSA-82j2-j2ch-gfr8). Fix: Update that package to its patched version.
Worth fixing GHSA-82j2-j2ch-gfr8 rustls-webpki: Denial of service via panic on malformed CRL BIT STRING

Cargo.lock

A package you depend on has a known security hole (GHSA-82j2-j2ch-gfr8). Fix: Update that package to its patched version.
Worth fixing GHSA-pwjx-qhcg-rvj4 webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic

Cargo.lock

A package you depend on has a known security hole (GHSA-pwjx-qhcg-rvj4). Fix: Update that package to its patched version.
Worth fixing CVE-2026-25727 time: time affected by a stack exhaustion denial of service attack

Cargo.lock

A package you depend on has a known security hole (CVE-2026-25727). Fix: Update that package to its patched version.
Worth fixing CVE-2026-24116 Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and ...

Cargo.lock

A package you depend on has a known security hole (CVE-2026-24116). Fix: Update that package to its patched version.
Worth fixing CVE-2026-27204 wasmtime: Wasmtime: Denial of Service via guest-controlled resource exhaustion in WASI host interfaces

Cargo.lock

A package you depend on has a known security hole (CVE-2026-27204). Fix: Update that package to its patched version.
Worth fixing CVE-2026-27572 wasmtime: Wasmtime: Denial of Service via excessive HTTP header fields

Cargo.lock

A package you depend on has a known security hole (CVE-2026-27572). Fix: Update that package to its patched version.
Worth fixing CVE-2026-34941 wasmtime: Wasmtime: Denial of Service and potential information disclosure via incorrect UTF-16 string validation

Cargo.lock

A package you depend on has a known security hole (CVE-2026-34941). Fix: Update that package to its patched version.
Worth fixing CVE-2026-34942 wasmtime: Wasmtime: Denial of Service via improper string alignment verification

Cargo.lock

A package you depend on has a known security hole (CVE-2026-34942). Fix: Update that package to its patched version.

… 78 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 162 found · 3 serious

Your dependencies cross-checked against the OSV vulnerability database.

Serious RUSTSEC-2026-0095 Wasmtime with Winch compiler backend may allow a sandbox-escaping memory access

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole (CVE-2026-34987). Fix: Update that package to its patched version.
Serious RUSTSEC-2026-0096 Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole (CVE-2026-34971). Fix: Update that package to its patched version.
Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/script/issue_response/pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
Worth fixing GHSA-35rm-7j9c-2f7m async-tar PAX extension-header desync enables tar entry/content smuggling

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole (CVE-2026-53600). Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0045 Timing Side-Channel in AES-CCM Tag Verification in AWS-LC

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole (CVE-2026-3337). Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0046 PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole (CVE-2026-3336). Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0047 PKCS7_verify Signature Validation Bypass in AWS-LC

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole (CVE-2026-3338). Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0048 CRL Distribution Point Scope Check Logic Error in AWS-LC

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole (CVE-2026-4428). Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2026-0007 Integer overflow in `BytesMut::reserve`

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole (CVE-2026-25541). Fix: Update that package to its patched version.
Worth fixing GHSA-f26g-jm89-4g65 gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole (CVE-2026-40034). Fix: Update that package to its patched version.
Worth fixing GHSA-fr8x-3vfx-f45h gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-p3hw-mv63-rf9w gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-pg4w-g64p-qwhj gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing RUSTSEC-2025-0140 Non-utf8 String can be created with `TimeBuf::as_str`

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole (CVE-2026-0810). Fix: Update that package to its patched version.
Worth fixing GHSA-f89h-2fjh-2r9q gix-fs: Symlink prefix-reuse allows worktree escape during checkout

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole (CVE-2026-44471). Fix: Update that package to its patched version.
Worth fixing GHSA-f89h-2fjh-2r9q gix-fs: Symlink prefix-reuse allows worktree escape during checkout

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole (CVE-2026-44471). Fix: Update that package to its patched version.
Worth fixing GHSA-x494-mj8g-cj27 gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-9857-6mw7-fq2m gix-transport: HTTP credentials leaked to redirected host in curl backend

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-p3hw-mv63-rf9w gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-p3hw-mv63-rf9w gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Worth fixing GHSA-38c5-483c-4qqp Grid: Integer Overflow in Grid::expand_rows Leads to Safe-API Undefined Behavior

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole (CVE-2026-42199). Fix: Update that package to its patched version.
Worth fixing GHSA-8c75-8mhr-p7r9 rust-openssl has incorrect bounds assertion in aes key wrap

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole (CVE-2026-41678). Fix: Update that package to its patched version.
Worth fixing GHSA-ghm9-cr32-g9qj rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole (CVE-2026-41681). Fix: Update that package to its patched version.
Worth fixing GHSA-hppc-g8h3-xhp3 rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole (CVE-2026-41898). Fix: Update that package to its patched version.
Worth fixing GHSA-phqj-4mhp-q6mq rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers

/workdirs/scan-ab061c45-4f47-413a-ae45-fe789a831737/Cargo.lock

A package you depend on has a known security hole (CVE-2026-45784). Fix: Update that package to its patched version.

… 137 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.