Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
Nothing found by this check. ✓
Packages you depend on that have known security holes (CVEs).
CVE-2026-33186 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validationCVE-2026-4800 lodash: lodash: Arbitrary code execution via untrusted input in template importsCVE-2025-13465 lodash: prototype pollution in _.unset and _.omit functionsCVE-2026-2950 lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypassCVE-2026-4867 path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parametersCVE-2026-8723 ### Summary `qs.stringify` throws `TypeError` when called with `arr ...GHSA-xmrv-pmrh-hhx2 Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream DecoderGHSA-xmrv-pmrh-hhx2 Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream DecoderCVE-2026-4660 go-getter: go-getter: Arbitrary file reads via maliciously crafted URLCVE-2025-64702 github.com/quic-go/quic-go/http3: quic-go HTTP/3 QPACK Header Expansion DoSCVE-2026-40898 quic-go is an implementation of the QUIC protocol in Go. Prior to vers ...CVE-2026-39827 An authenticated SSH client that repeatedly opened channels which were ...CVE-2026-39828 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissionsCVE-2026-39829 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parametersCVE-2026-39830 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responsesCVE-2026-39832 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictionsCVE-2026-39835 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificateCVE-2026-42508 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKeyCVE-2026-46595 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validationCVE-2026-46597 An incorrectly placed cast from bytes to int allowed for server-side p ...CVE-2025-47914 golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messagesCVE-2025-58181 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authenticationCVE-2026-39831 The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nis ...CVE-2026-39833 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmationCVE-2026-39834 When writing data larger than 4GB in a single Write call on an SSH cha ...Your dependencies cross-checked against the OSV vulnerability database.
GHSA-2w6w-674q-4c4q Handlebars.js has JavaScript Injection via AST Type ConfusionGO-2026-5005 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agentGO-2026-5006 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agentGO-2026-5017 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/sshGO-2026-5019 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/sshGO-2026-5020 Invoking infinite loop on large channel writes in golang.org/x/crypto/sshGO-2026-5021 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhostsGO-2026-5023 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/sshGO-2026-4762 Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpcGHSA-36hh-x5p5-jgc8 @hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parametersGHSA-jg4p-7fhp-p32p @hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsingGHSA-vhjm-w67q-g75c @hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirectsGHSA-x426-x7cc-3fpc @hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirectsGHSA-7h2j-956f-4vf2 @isaacs/brace-expansion has Uncontrolled Resource ConsumptionGHSA-2v35-w6hq-6mfw xmldom: Uncontrolled recursion in XML serialization leads to DoSGHSA-f6ww-3ggp-fr8h xmldom has XML injection through unvalidated DocumentType serializationGHSA-j759-j44w-7fr8 xmldom has XML node injection through unvalidated comment serializationGHSA-wh4c-j3r5-mjhp xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertionGHSA-x6wf-f3px-wcqx xmldom has XML node injection through unvalidated processing instruction serializationGHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` optionGHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustionGHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustionGHSA-3c8v-cfp5-9885 Electron: Out-of-bounds read in second-instance IPC on macOS and LinuxGHSA-4p4r-m79c-wq3v Electron: HTTP Response Header Injection in custom protocol handlers and webRequestGHSA-532v-xpq5-8h95 Electron: Use-after-free in offscreen child window paint callbackCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
scorecard-overall OpenSSF Scorecard overall: 2.9/10scorecard-CII-Best-Practices CII-Best-Practices scored 0: no effort to earn an OpenSSF best practices badge detectedscorecard-Code-Review Code-Review scored 0: Found 0/30 approved changesets -- score normalized to 0scorecard-Dependency-Update-Tool Dependency-Update-Tool scored 0: no update tool detectedscorecard-Fuzzing Fuzzing scored 0: project is not fuzzedscorecard-Maintained Maintained scored 0: 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0scorecard-Pinned-Dependencies Pinned-Dependencies scored 0: dependency not pinned by hash detected -- score normalized to 0scorecard-SAST SAST scored 0: no SAST tool detectedscorecard-Security-Policy Security-Policy scored 0: security policy file not detectedscorecard-Signed-Releases Signed-Releases scored 0: Project has not signed or included provenance with any releases.scorecard-Token-Permissions Token-Permissions scored 0: detected GitHub workflow tokens with excessive permissions