yamachu/isucon12-qualify-practice-template

API keys, passwords or tokens committed into the repo.

• Serious jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
  bench/cookie-jar.txt:5
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  bench/isuports.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  blackauth/isuports.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  isuports.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  nginx/tls/key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  provisioning/mitamae/cookbooks/nginx/tls/key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  secret.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  bench/isuports.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  blackauth/isuports.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  nginx/tls/key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  isuports.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  secret.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  provisioning/mitamae/cookbooks/nginx/tls/key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  bench/isuports.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  blackauth/isuports.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  isuports.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  nginx/tls/key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  provisioning/mitamae/cookbooks/nginx/tls/key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  secret.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  bench/isuports.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  blackauth/isuports.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  nginx/tls/key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  provisioning/mitamae/cookbooks/nginx/tls/key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  isuports.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  secret.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2022-40083 Labstack Echo v4.8.0 was discovered to contain an open redirect vulner ...
  bench/go.mod
  A package you depend on has a known security hole (CVE-2022-40083). Fix: Update that package to its patched version.
• Serious CVE-2022-40083 Labstack Echo v4.8.0 was discovered to contain an open redirect vulner ...
  data/go.mod
  A package you depend on has a known security hole (CVE-2022-40083). Fix: Update that package to its patched version.
• Serious CVE-2025-7783 form-data: Unsafe random function in form-data
  frontend/package-lock.json
  A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
• Serious CVE-2026-33186 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
  isucon12-portal/go.mod
  A package you depend on has a known security hole (CVE-2026-33186). Fix: Update that package to its patched version.
• Serious CVE-2022-40083 Labstack Echo v4.8.0 was discovered to contain an open redirect vulner ...
  webapp/go/go.mod
  A package you depend on has a known security hole (CVE-2022-40083). Fix: Update that package to its patched version.
• Serious CVE-2024-21508 mysql2: Remote Code Execution
  webapp/node/package-lock.json
  A package you depend on has a known security hole (CVE-2024-21508). Fix: Update that package to its patched version.
• Serious CVE-2024-21511 mysql2: Arbitrary Code Injection due to improper sanitization of the timezone parameter
  webapp/node/package-lock.json
  A package you depend on has a known security hole (CVE-2024-21511). Fix: Update that package to its patched version.
• Serious CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb
  webapp/node/package-lock.json
  A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-49290 jwx: Malicious parameters in JWE can cause denial of service
  bench/go.mod
  A package you depend on has a known security hole (CVE-2023-49290). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-21664 jwx: parsing JSON serialized payload without protected field can lead to panic
  bench/go.mod
  A package you depend on has a known security hole (CVE-2024-21664). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-28122 jwx: denial of service attack using compressed JWE message
  bench/go.mod
  A package you depend on has a known security hole (CVE-2024-28122). Fix: Update that package to its patched version.
• Worth fixing GHSA-rm8v-mxj3-5rmq github.com/lestrrat-go/jwx vulnerable to Potential Padding Oracle Attack
  bench/go.mod
  A package you depend on has a known security hole (GHSA-rm8v-mxj3-5rmq). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-45337 golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
  bench/go.mod
  A package you depend on has a known security hole (CVE-2024-45337). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-22869 golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
  bench/go.mod
  A package you depend on has a known security hole (CVE-2025-22869). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-47913 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS
  bench/go.mod
  A package you depend on has a known security hole (CVE-2025-47913). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39828 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
  bench/go.mod
  A package you depend on has a known security hole (CVE-2026-39828). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39829 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
  bench/go.mod
  A package you depend on has a known security hole (CVE-2026-39829). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39830 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
  bench/go.mod
  A package you depend on has a known security hole (CVE-2026-39830). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39831 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
  bench/go.mod
  A package you depend on has a known security hole (CVE-2026-39831). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39832 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
  bench/go.mod
  A package you depend on has a known security hole (CVE-2026-39832). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-39835 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
  bench/go.mod
  A package you depend on has a known security hole (CVE-2026-39835). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-42508 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
  bench/go.mod
  A package you depend on has a known security hole (CVE-2026-42508). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-46595 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
  bench/go.mod
  A package you depend on has a known security hole (CVE-2026-46595). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-46597 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
  bench/go.mod
  A package you depend on has a known security hole (CVE-2026-46597). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-48795 ssh: Prefix truncation attack on Binary Packet Protocol (BPP)
  bench/go.mod
  A package you depend on has a known security hole (CVE-2023-48795). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious GO-2022-1031 Open redirect in github.com/labstack/echo/v4
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/bench/go.mod
  A package you depend on has a known security hole (CVE-2022-40083). Fix: Update that package to its patched version.
• Serious GO-2024-3321 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/bench/go.mod
  A package you depend on has a known security hole (CVE-2024-45337). Fix: Update that package to its patched version.
• Serious GO-2026-5005 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/bench/go.mod
  A package you depend on has a known security hole (CVE-2026-39833). Fix: Update that package to its patched version.
• Serious GO-2026-5006 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/bench/go.mod
  A package you depend on has a known security hole (CVE-2026-39832). Fix: Update that package to its patched version.
• Serious GO-2026-5017 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/bench/go.mod
  A package you depend on has a known security hole (CVE-2026-39830). Fix: Update that package to its patched version.
• Serious GO-2026-5019 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/bench/go.mod
  A package you depend on has a known security hole (CVE-2026-39831). Fix: Update that package to its patched version.
• Serious GO-2026-5020 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/bench/go.mod
  A package you depend on has a known security hole (CVE-2026-39834). Fix: Update that package to its patched version.
• Serious GO-2026-5021 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/bench/go.mod
  A package you depend on has a known security hole (CVE-2026-42508). Fix: Update that package to its patched version.
• Serious GO-2026-5023 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/bench/go.mod
  A package you depend on has a known security hole (CVE-2026-46595). Fix: Update that package to its patched version.
• Serious GO-2024-3321 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/blackauth/go.mod
  A package you depend on has a known security hole (CVE-2024-45337). Fix: Update that package to its patched version.
• Serious GO-2026-5005 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/blackauth/go.mod
  A package you depend on has a known security hole (CVE-2026-39833). Fix: Update that package to its patched version.
• Serious GO-2026-5006 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/blackauth/go.mod
  A package you depend on has a known security hole (CVE-2026-39832). Fix: Update that package to its patched version.
• Serious GO-2026-5017 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/blackauth/go.mod
  A package you depend on has a known security hole (CVE-2026-39830). Fix: Update that package to its patched version.
• Serious GO-2026-5019 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/blackauth/go.mod
  A package you depend on has a known security hole (CVE-2026-39831). Fix: Update that package to its patched version.
• Serious GO-2026-5020 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/blackauth/go.mod
  A package you depend on has a known security hole (CVE-2026-39834). Fix: Update that package to its patched version.
• Serious GO-2026-5021 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/blackauth/go.mod
  A package you depend on has a known security hole (CVE-2026-42508). Fix: Update that package to its patched version.
• Serious GO-2026-5023 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/blackauth/go.mod
  A package you depend on has a known security hole (CVE-2026-46595). Fix: Update that package to its patched version.
• Serious GO-2022-1031 Open redirect in github.com/labstack/echo/v4
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/data/go.mod
  A package you depend on has a known security hole (CVE-2022-40083). Fix: Update that package to its patched version.
• Serious GO-2024-3321 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/data/go.mod
  A package you depend on has a known security hole (CVE-2024-45337). Fix: Update that package to its patched version.
• Serious GO-2026-5005 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/data/go.mod
  A package you depend on has a known security hole (CVE-2026-39833). Fix: Update that package to its patched version.
• Serious GO-2026-5006 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/data/go.mod
  A package you depend on has a known security hole (CVE-2026-39832). Fix: Update that package to its patched version.
• Serious GO-2026-5017 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/data/go.mod
  A package you depend on has a known security hole (CVE-2026-39830). Fix: Update that package to its patched version.
• Serious GO-2026-5019 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/data/go.mod
  A package you depend on has a known security hole (CVE-2026-39831). Fix: Update that package to its patched version.
• Serious GO-2026-5020 Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/data/go.mod
  A package you depend on has a known security hole (CVE-2026-39834). Fix: Update that package to its patched version.
• Serious GO-2026-5021 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
  /workdirs/scan-f2d46720-6652-40cd-b521-983ce0cef079/data/go.mod
  A package you depend on has a known security hole (CVE-2026-42508). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0