zeke/ai

scanned 2026-08-08 · git 8fa9cc1

3 of 6 checks flagged a security issue

🔴 Needs attention

Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets2Vulnerable dependencies389Known OSS vulnerabilities525Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ 2 found

API keys, passwords or tokens committed into the repo.

Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

examples/ai-core/.env.example:19

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

examples/swarm/.env.example:12

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 389 found · 12 serious

Packages you depend on that have known security holes (CVEs).

Serious CVE-2025-43859 h11: h11 accepts some malformed Chunked-Encoding bodies

examples/next-fastapi/requirements.txt

A package you depend on has a known security hole (CVE-2025-43859). Fix: Update that package to its patched version.
Serious CVE-2026-25896 fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling

pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2026-25896). Fix: Update that package to its patched version.
Serious CVE-2025-7783 form-data: Unsafe random function in form-data

pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
Serious CVE-2025-29927 nextjs: Authorization Bypass in Next.js Middleware

pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2025-29927). Fix: Update that package to its patched version.
Serious CVE-2025-55182 next: React Server Components: Pre-authentication remote code execution via unsafe deserialization

pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2025-55182). Fix: Update that package to its patched version.
Serious CVE-2025-29927 nextjs: Authorization Bypass in Next.js Middleware

pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2025-29927). Fix: Update that package to its patched version.
Serious CVE-2025-55182 next: React Server Components: Pre-authentication remote code execution via unsafe deserialization

pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2025-55182). Fix: Update that package to its patched version.
Serious CVE-2026-41242 protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields

pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2026-41242). Fix: Update that package to its patched version.
Serious CVE-2026-59940 seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2026-59940). Fix: Update that package to its patched version.
Serious CVE-2026-59940 seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2026-59940). Fix: Update that package to its patched version.
Serious CVE-2026-59940 seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2026-59940). Fix: Update that package to its patched version.
Serious CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb

pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
Worth fixing CVE-2024-56201 jinja2: Jinja has a sandbox breakout through malicious filenames

examples/next-fastapi/requirements.txt

A package you depend on has a known security hole (CVE-2024-56201). Fix: Update that package to its patched version.
Worth fixing CVE-2024-56326 jinja2: Jinja has a sandbox breakout through indirect reference to format method

examples/next-fastapi/requirements.txt

A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
Worth fixing CVE-2025-27516 jinja2: Jinja sandbox breakout through attr filter selecting format method

examples/next-fastapi/requirements.txt

A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
Worth fixing CVE-2026-45409 python-idna: idna: Denial of Service via specially crafted long inputs

examples/next-fastapi/requirements.txt

A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
Worth fixing CVE-2026-28684 python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following

examples/next-fastapi/requirements.txt

A package you depend on has a known security hole (CVE-2026-28684). Fix: Update that package to its patched version.
Worth fixing CVE-2024-53981 python-multipart: python-multipart has a DoS via deformation `multipart/form-data` boundary

examples/next-fastapi/requirements.txt

A package you depend on has a known security hole (CVE-2024-53981). Fix: Update that package to its patched version.
Worth fixing CVE-2026-24486 python-multipart: Python-Multipart: Arbitrary file write via path traversal vulnerability

examples/next-fastapi/requirements.txt

A package you depend on has a known security hole (CVE-2026-24486). Fix: Update that package to its patched version.
Worth fixing CVE-2026-42561 python-multipart: python-multipart: Denial of Service via excessive multipart part headers

examples/next-fastapi/requirements.txt

A package you depend on has a known security hole (CVE-2026-42561). Fix: Update that package to its patched version.
Worth fixing CVE-2026-53539 python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies

examples/next-fastapi/requirements.txt

A package you depend on has a known security hole (CVE-2026-53539). Fix: Update that package to its patched version.
Worth fixing CVE-2026-40347 python-multipart: Python-Multipart: Denial of Service via crafted multipart/form-data requests

examples/next-fastapi/requirements.txt

A package you depend on has a known security hole (CVE-2026-40347). Fix: Update that package to its patched version.
Worth fixing CVE-2024-47874 starlette: Starlette Denial of service (DoS) via multipart/form-data

examples/next-fastapi/requirements.txt

A package you depend on has a known security hole (CVE-2024-47874). Fix: Update that package to its patched version.
Worth fixing CVE-2026-48818 starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

examples/next-fastapi/requirements.txt

A package you depend on has a known security hole (CVE-2026-48818). Fix: Update that package to its patched version.
Worth fixing CVE-2026-54283 starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

examples/next-fastapi/requirements.txt

A package you depend on has a known security hole (CVE-2026-54283). Fix: Update that package to its patched version.

… 364 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 525 found · 21 serious

Your dependencies cross-checked against the OSV vulnerability database.

Serious PYSEC-2026-348 h11 accepts some malformed Chunked-Encoding bodies

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/examples/next-fastapi/requirements.txt

A package you depend on has a known security hole (CVE-2025-43859). Fix: Update that package to its patched version.
Serious GHSA-279x-mwfv-vcqv Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2026-71319). Fix: Update that package to its patched version.
Serious GHSA-m7jm-9gc2-mpf2 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2026-25896). Fix: Update that package to its patched version.
Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
Serious GHSA-593f-38f6-jp5m Inefficient Regular Expression Complexity in koa

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2025-25200). Fix: Update that package to its patched version.
Serious GHSA-9qr9-h5gf-34mp Next.js is vulnerable to RCE in React flight protocol

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Serious GHSA-9qr9-h5gf-34mp Next.js is vulnerable to RCE in React flight protocol

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Serious GHSA-f82v-jwr5-mffw Authorization Bypass in Next.js Middleware

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2025-29927). Fix: Update that package to its patched version.
Serious GHSA-9qr9-h5gf-34mp Next.js is vulnerable to RCE in React flight protocol

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole. Fix: Update that package to its patched version.
Serious GHSA-f82v-jwr5-mffw Authorization Bypass in Next.js Middleware

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2025-29927). Fix: Update that package to its patched version.
Serious GHSA-xq3m-2v4x-88gg Arbitrary code execution in protobufjs

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2026-41242). Fix: Update that package to its patched version.
Serious GHSA-mv8w-475r-vwqw seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2026-59940). Fix: Update that package to its patched version.
Serious GHSA-mv8w-475r-vwqw seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2026-59940). Fix: Update that package to its patched version.
Serious GHSA-mv8w-475r-vwqw seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2026-59940). Fix: Update that package to its patched version.
Serious GHSA-w7jw-789q-3m8p shell-quote quote() does not escape newlines in object .op values

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2026-9277). Fix: Update that package to its patched version.
Serious GHSA-hffm-xvc3-vprc simple-git is vulnerable to Remote Code Execution

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2026-6951). Fix: Update that package to its patched version.
Serious GHSA-r275-fr43-pm7q simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2026-28292). Fix: Update that package to its patched version.
Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
Serious GHSA-3qcw-2rhx-2726 Turbo: Unexpected local code execution during Yarn Berry detection

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2026-45772). Fix: Update that package to its patched version.
Serious GHSA-5xrq-8626-4rwp When Vitest UI server is listening, arbitrary file can be read and executed

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2026-47429). Fix: Update that package to its patched version.
Serious GHSA-9crc-q9x8-hgqq Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/pnpm-lock.yaml

A package you depend on has a known security hole (CVE-2025-24964). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-1471 Jinja2 vulnerable to sandbox breakout through attr filter selecting format method

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/examples/next-fastapi/requirements.txt

A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-1472 Jinja has a sandbox breakout through malicious filenames

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/examples/next-fastapi/requirements.txt

A package you depend on has a known security hole (CVE-2024-56201). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-1475 Jinja has a sandbox breakout through indirect reference to format method

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/examples/next-fastapi/requirements.txt

A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
Worth fixing PYSEC-2026-2132 Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.

/workdirs/scan-f789b07f-50de-4942-a93c-156290f26df5/examples/next-fastapi/requirements.txt

A package you depend on has a known security hole (CVE-2026-7246). Fix: Update that package to its patched version.

… 500 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: npm:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.