Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

oblien/openship

https://github.com/oblien/openship · scanned 2026-07-23 10:38 UTC (5 days, 6 hours ago)

855 raw signals (0 security + 855 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 5 days, 6 hours ago · v5 · last Δ +14.4 (diff) · 852 actionable findings from 1 signal source. 3 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
51.3
/100
Security checks
51
0 findings
System graph
51
100.0% cov · 852 findings
Critical
3
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 3 High 49 Medium 226 Low 186 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 852 Crowd 0 Layer: Frontend 202 Security 46 Network 6 Hardware 7 Cicd 4 Quality 323 Dependencies 194 Api 70
Scan summary Repository scanned at 51.3/100 with 100.0% coverage. It contains 10175 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 855 findings — concentrated in quality (323), frontend (202), dependencies (194). Risk profile is high: 3 critical, 49 high, 229 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 462 of 852 actionable findings. 855 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical System graph security security conf 1.00 Insecure pattern 'private_key_in_repo' in apps/dashboard/src/i18n/locales/en/projectSettings.json:739
Found a known-risky pattern (private_key_in_repo). Review and replace if possible.
apps/dashboard/src/i18n/locales/en/projectSettings.json:739 Private key in repo
critical System graph security security conf 1.00 Insecure pattern 'private_key_in_repo' in apps/dashboard/src/i18n/locales/fr/projectSettings.json:672
Found a known-risky pattern (private_key_in_repo). Review and replace if possible.
apps/dashboard/src/i18n/locales/fr/projectSettings.json:672 Private key in repo
critical System graph security security conf 1.00 Insecure pattern 'private_key_in_repo' in apps/dashboard/src/i18n/locales/tr/projectSettings.json:739
Found a known-risky pattern (private_key_in_repo). Review and replace if possible.
apps/dashboard/src/i18n/locales/tr/projectSettings.json:739 Private key in repo
high System graph api Wiring conf 1.00 Dangling fetch: GET /api/projects/home (apps/api/src/lib/cloud/projects.ts:29)
`apps/api/src/lib/cloud/projects.ts:29` calls `GET /api/projects/home` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/projects/home` If this points at an external API, prefix it with `https://` so the match…
Dangling fetchHelper:request
high System graph api Wiring conf 1.00 Dangling fetch: GET /api/v1/shortcuts (apps/email/client/lib/hotkeys/use-hotkey-utils.ts:12)
`apps/email/client/lib/hotkeys/use-hotkey-utils.ts:12` calls `GET /api/v1/shortcuts` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: axios Normalized path used for matching: `/v1/shortcuts` If this points at an external API, prefix it with `https://` so the m…
Dangling fetchAxios
high System graph api Wiring conf 1.00 Dangling fetch: GET http://127.0.0.1:${apiPort}/api/health (apps/cli/src/commands/wizard.ts:116)
`apps/cli/src/commands/wizard.ts:116` calls `GET http://127.0.0.1:${apiPort}/api/health` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/api/health` If this points at an external API, prefix it w…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET http://127.0.0.1:${dashPort} (apps/cli/src/commands/up.ts:493)
`apps/cli/src/commands/up.ts:493` calls `GET http://127.0.0.1:${dashPort}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>` If this points at an external API, prefix it with `https://` so the mat…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET http://127.0.0.1:${dashPort}/ (apps/cli/src/commands/wizard.ts:132)
`apps/cli/src/commands/wizard.ts:132` calls `GET http://127.0.0.1:${dashPort}/` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>` If this points at an external API, prefix it with `https://` so th…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET http://127.0.0.1:${port}${path} (apps/cli/src/commands/wizard.ts:58)
`apps/cli/src/commands/wizard.ts:58` calls `GET http://127.0.0.1:${port}${path}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/<p>` If this points at an external API, prefix it with `https://` …
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET http://127.0.0.1:${port}/api/system/self-register/stream?id=${sessionId} (apps/cli/src/commands/wizard.ts:280)
`apps/cli/src/commands/wizard.ts:280` calls `GET http://127.0.0.1:${port}/api/system/self-register/stream?id=${sessionId}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/api/system/self-register…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET https://api.github.com/repos/${repo}/releases/latest (apps/api/src/lib/release-dist.ts:179)
`apps/api/src/lib/release-dist.ts:179` calls `GET https://api.github.com/repos/${repo}/releases/latest` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.github.com/repos/<p>/releases/latest` If this points …
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET https://api.github.com/repos/${repo}/releases/latest (apps/api/src/lib/release-resolver.ts:179)
`apps/api/src/lib/release-resolver.ts:179` calls `GET https://api.github.com/repos/${repo}/releases/latest` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.github.com/repos/<p>/releases/latest` If this poi…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET https://api.github.com/repos/oblien/openship/releases/latest (apps/web/src/app/(site)/download/page.tsx:110)
`apps/web/src/app/(site)/download/page.tsx:110` calls `GET https://api.github.com/repos/oblien/openship/releases/latest` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.github.com/repos/oblien/openship/rel…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET https://api.github.com/user (apps/api/src/modules/github/github.auth.ts:669)
`apps/api/src/modules/github/github.auth.ts:669` calls `GET https://api.github.com/user` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.github.com/user` If this points at an external API, prefix it with `…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET https://api.github.com/user (apps/api/src/modules/github/github.local-auth.ts:103)
`apps/api/src/modules/github/github.local-auth.ts:103` calls `GET https://api.github.com/user` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.github.com/user` If this points at an external API, prefix it …
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: GET https://api.github.com/user (apps/api/src/modules/github/github.service.ts:104)
`apps/api/src/modules/github/github.service.ts:104` calls `GET https://api.github.com/user` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/api.github.com/user` If this points at an external API, prefix it wit…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: HEAD https://${registry}/v2/${repo}/manifests/${encodeURIComponent(ref)} (apps/api/src/lib/image-registry.ts:115)
`apps/api/src/lib/image-registry.ts:115` calls `HEAD https://${registry}/v2/${repo}/manifests/${encodeURIComponent(ref)}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/<p>/v2/<p>/manifests/<p>` If this point…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST /echo (apps/api/test/middleware/json-error-handler.test.ts:29)
`apps/api/test/middleware/json-error-handler.test.ts:29` calls `POST /echo` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/echo` If this points at an external API, prefix it with `https://` so the matcher s…
Dangling fetchHelper:request
high System graph api Wiring conf 1.00 Dangling fetch: POST /echo (apps/api/test/middleware/json-error-handler.test.ts:41)
`apps/api/test/middleware/json-error-handler.test.ts:41` calls `POST /echo` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: helper:request Normalized path used for matching: `/echo` If this points at an external API, prefix it with `https://` so the matcher s…
Dangling fetchHelper:request
high System graph api Wiring conf 1.00 Dangling fetch: POST /oauth2/consent (apps/dashboard/src/app/mcp/authorize/page.tsx:63)
`apps/dashboard/src/app/mcp/authorize/page.tsx:63` calls `POST /oauth2/consent` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/oauth2/consent` If this points at an external API, prefix it with `https://` so the matc…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST http://127.0.0.1:${OPENRESTY_MGMT_PORT}/rules (apps/api/src/modules/route-rules/route-rule.service.ts:75)
`apps/api/src/modules/route-rules/route-rule.service.ts:75` calls `POST http://127.0.0.1:${OPENRESTY_MGMT_PORT}/rules` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/rules` If this points at an …
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST http://127.0.0.1:${port}${path} (apps/cli/src/commands/wizard.ts:71)
`apps/cli/src/commands/wizard.ts:71` calls `POST http://127.0.0.1:${port}${path}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/<p>` If this points at an external API, prefix it with `https://`…
Dangling fetchFetch
high System graph api Wiring conf 1.00 Dangling fetch: POST http://127.0.0.1:${port}/api/system/reset-admin-password (apps/cli/src/commands/reset-admin.ts:67)
`apps/cli/src/commands/reset-admin.ts:67` calls `POST http://127.0.0.1:${port}/api/system/reset-admin-password` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/127.0.0.1:/<p>/api/system/reset-admin-password` If…
Dangling fetchFetch
high System graph security security conf 1.00 Insecure pattern 'exec_used' in packages/adapters/src/runtime/build-pipeline.ts:116
Found a known-risky pattern (exec_used). Review and replace if possible.
packages/adapters/src/runtime/build-pipeline.ts:116 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in packages/adapters/src/system/local-executor.ts:25
Found a known-risky pattern (exec_used). Review and replace if possible.
packages/adapters/src/system/local-executor.ts:25 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in packages/adapters/src/system/port-listen.ts:20
Found a known-risky pattern (exec_used). Review and replace if possible.
packages/adapters/src/system/port-listen.ts:20 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in packages/adapters/src/system/remote-transfer.ts:81
Found a known-risky pattern (exec_used). Review and replace if possible.
packages/adapters/src/system/remote-transfer.ts:81 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in packages/adapters/src/system/ssh-executor.ts:200
Found a known-risky pattern (exec_used). Review and replace if possible.
packages/adapters/src/system/ssh-executor.ts:200 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in packages/adapters/src/system/system-ssh-executor.ts:218
Found a known-risky pattern (exec_used). Review and replace if possible.
packages/adapters/src/system/system-ssh-executor.ts:218 Exec used
high System graph security security conf 1.00 Insecure pattern 'exec_used' in packages/adapters/src/types.ts:484
Found a known-risky pattern (exec_used). Review and replace if possible.
packages/adapters/src/types.ts:484 Exec used
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in apps/api/scripts/build-release.ts:51
Found a known-risky pattern (node_child_process). Review and replace if possible.
apps/api/scripts/build-release.ts:51 Node child process
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in apps/email/scripts/build-release.ts:36
Found a known-risky pattern (node_child_process). Review and replace if possible.
apps/email/scripts/build-release.ts:36 Node child process
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in packages/adapters/src/system/local-executor.ts:1
Found a known-risky pattern (node_child_process). Review and replace if possible.
packages/adapters/src/system/local-executor.ts:1 Node child process
high System graph security auth conf 1.00 JS DELETE `/admin/:serverId/domains/:domain` admin endpoint without auth — apps/api/src/modules/mail/mail.routes.ts:70
Admin-scoped JS route with no recognizable auth: no middleware-position guard, no router-level guard above it in this file, and no inline permission call within the first 15 lines of the handler. If auth is applied where this router is mounted, dismiss with reason `by_design` or tag the route `// p…
apps/api/src/modules/mail/mail.routes.ts:70 securityAuth js admin unauth
high System graph security auth conf 1.00 JS DELETE `/admin/:serverId/mailboxes/:email` admin endpoint without auth — apps/api/src/modules/mail/mail.routes.ts:117
Admin-scoped JS route with no recognizable auth: no middleware-position guard, no router-level guard above it in this file, and no inline permission call within the first 15 lines of the handler. If auth is applied where this router is mounted, dismiss with reason `by_design` or tag the route `// p…
apps/api/src/modules/mail/mail.routes.ts:117 securityAuth js admin unauth
high System graph security auth conf 1.00 JS DELETE `/admin/:serverId/relay` admin endpoint without auth — apps/api/src/modules/mail/mail.routes.ts:165
Admin-scoped JS route with no recognizable auth: no middleware-position guard, no router-level guard above it in this file, and no inline permission call within the first 15 lines of the handler. If auth is applied where this router is mounted, dismiss with reason `by_design` or tag the route `// p…
apps/api/src/modules/mail/mail.routes.ts:165 securityAuth js admin unauth
high System graph security auth conf 1.00 JS PATCH `/admin/:serverId/domains/:domain` admin endpoint without auth — apps/api/src/modules/mail/mail.routes.ts:65
Admin-scoped JS route with no recognizable auth: no middleware-position guard, no router-level guard above it in this file, and no inline permission call within the first 15 lines of the handler. If auth is applied where this router is mounted, dismiss with reason `by_design` or tag the route `// p…
apps/api/src/modules/mail/mail.routes.ts:65 securityAuth js admin unauth
high System graph security auth conf 1.00 JS PATCH `/admin/:serverId/mailboxes/:email` admin endpoint without auth — apps/api/src/modules/mail/mail.routes.ts:112
Admin-scoped JS route with no recognizable auth: no middleware-position guard, no router-level guard above it in this file, and no inline permission call within the first 15 lines of the handler. If auth is applied where this router is mounted, dismiss with reason `by_design` or tag the route `// p…
apps/api/src/modules/mail/mail.routes.ts:112 securityAuth js admin unauth
high System graph security auth conf 1.00 JS POST `/admin/:serverId/backup-policy` admin endpoint without auth — apps/api/src/modules/mail/mail.routes.ts:136
Admin-scoped JS route with no recognizable auth: no middleware-position guard, no router-level guard above it in this file, and no inline permission call within the first 15 lines of the handler. If auth is applied where this router is mounted, dismiss with reason `by_design` or tag the route `// p…
apps/api/src/modules/mail/mail.routes.ts:136 securityAuth js admin unauth
high System graph security auth conf 1.00 JS POST `/admin/:serverId/components/:key/:action` admin endpoint without auth — apps/api/src/modules/mail/mail.routes.ts:184
Admin-scoped JS route with no recognizable auth: no middleware-position guard, no router-level guard above it in this file, and no inline permission call within the first 15 lines of the handler. If auth is applied where this router is mounted, dismiss with reason `by_design` or tag the route `// p…
apps/api/src/modules/mail/mail.routes.ts:184 securityAuth js admin unauth
high System graph security auth conf 1.00 JS POST `/admin/:serverId/components/restart-all` admin endpoint without auth — apps/api/src/modules/mail/mail.routes.ts:179
Admin-scoped JS route with no recognizable auth: no middleware-position guard, no router-level guard above it in this file, and no inline permission call within the first 15 lines of the handler. If auth is applied where this router is mounted, dismiss with reason `by_design` or tag the route `// p…
apps/api/src/modules/mail/mail.routes.ts:179 securityAuth js admin unauth
high System graph security auth conf 1.00 JS POST `/admin/:serverId/domains/:domain/dns/acknowledge` admin endpoint without auth — apps/api/src/modules/mail/mail.routes.ts:85
Admin-scoped JS route with no recognizable auth: no middleware-position guard, no router-level guard above it in this file, and no inline permission call within the first 15 lines of the handler. If auth is applied where this router is mounted, dismiss with reason `by_design` or tag the route `// p…
apps/api/src/modules/mail/mail.routes.ts:85 securityAuth js admin unauth
high System graph security auth conf 1.00 JS POST `/admin/:serverId/domains` admin endpoint without auth — apps/api/src/modules/mail/mail.routes.ts:55
Admin-scoped JS route with no recognizable auth: no middleware-position guard, no router-level guard above it in this file, and no inline permission call within the first 15 lines of the handler. If auth is applied where this router is mounted, dismiss with reason `by_design` or tag the route `// p…
apps/api/src/modules/mail/mail.routes.ts:55 securityAuth js admin unauth
high System graph security auth conf 1.00 JS POST `/admin/:serverId/mailboxes` admin endpoint without auth — apps/api/src/modules/mail/mail.routes.ts:102
Admin-scoped JS route with no recognizable auth: no middleware-position guard, no router-level guard above it in this file, and no inline permission call within the first 15 lines of the handler. If auth is applied where this router is mounted, dismiss with reason `by_design` or tag the route `// p…
apps/api/src/modules/mail/mail.routes.ts:102 securityAuth js admin unauth
high System graph security auth conf 1.00 JS POST `/admin/:serverId/relay` admin endpoint without auth — apps/api/src/modules/mail/mail.routes.ts:160
Admin-scoped JS route with no recognizable auth: no middleware-position guard, no router-level guard above it in this file, and no inline permission call within the first 15 lines of the handler. If auth is applied where this router is mounted, dismiss with reason `by_design` or tag the route `// p…
apps/api/src/modules/mail/mail.routes.ts:160 securityAuth js admin unauth
high System graph security auth conf 1.00 JS POST `/admin/:serverId/test-email` admin endpoint without auth — apps/api/src/modules/mail/mail.routes.ts:172
Admin-scoped JS route with no recognizable auth: no middleware-position guard, no router-level guard above it in this file, and no inline permission call within the first 15 lines of the handler. If auth is applied where this router is mounted, dismiss with reason `by_design` or tag the route `// p…
apps/api/src/modules/mail/mail.routes.ts:172 securityAuth js admin unauth
high System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-88fw-hqm2-52qc
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-88fw-hqm2-52qc (aka CVE-2026-54290). hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard Aliases: CVE-2026-54290 Advisory: https://osv.dev/vulnerability/GHSA-88fw-…
bun.lock ScaOsvGhsa 88fw hqm2 52qc
high System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.23: GHSA-88fw-hqm2-52qc
OSV.dev reports `hono` at version `4.12.23` (resolved in `apps/email/server/bun.lock`) is affected by GHSA-88fw-hqm2-52qc (aka CVE-2026-54290). hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard Aliases: CVE-2026-54290 Advisory: https://osv.dev/vulne…
apps/email/server/package.json ScaOsvGhsa 88fw hqm2 52qc
high System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-88fw-hqm2-52qc
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-88fw-hqm2-52qc (aka CVE-2026-54290). hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard Aliases: CVE-2026-54290 Advisory: https://osv.dev/vulnerability/GHSA-88fw-…
apps/api/package.json ScaOsvGhsa 88fw hqm2 52qc
high System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.10.1: GHSA-p6gq-j5cr-w38f
OSV.dev reports `nodemailer` at version `6.10.1` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-p6gq-j5cr-w38f. Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message Advisory: …
apps/email/client/bun.lock ScaOsvGhsa p6gq j5cr w38f
high System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 8.0.5: GHSA-p6gq-j5cr-w38f
OSV.dev reports `nodemailer` at version `8.0.5` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-p6gq-j5cr-w38f. Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message Advisory: h…
apps/email/client/bun.lock ScaOsvGhsa p6gq j5cr w38f
high System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 8.0.7: GHSA-p6gq-j5cr-w38f
OSV.dev reports `nodemailer` at version `8.0.7` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-p6gq-j5cr-w38f. Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message Advisory: h…
apps/email/client/bun.lock ScaOsvGhsa p6gq j5cr w38f
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — apps/dashboard/src/app/layout.tsx:96
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — apps/dashboard/src/components/theme-provider.tsx:126
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — apps/email/client/components/ui/bimi-avatar.tsx:69
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — apps/email/client/components/ui/chart.tsx:73
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — apps/email/client/lib/email-utils.client.tsx:196
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — apps/email/client/lib/sanitize-tip-tap-html.tsx:17
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — apps/web/src/app/(site)/(marketing)/mail/page.tsx:71
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — apps/web/src/app/(site)/(marketing)/pricing/layout.tsx:115
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — apps/web/src/app/(site)/download/layout.tsx:75
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — apps/web/src/app/(site)/layout.tsx:177
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — apps/web/src/app/(site)/page.tsx:61
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — apps/web/src/app/(site)/resources/[...slug]/page.tsx:145
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — apps/web/src/app/(site)/resources/page.tsx:127
Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html
Fq dangerous html
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/api/src/lib/notification-workers.ts:166
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/api/src/modules/github/github.auth.ts:205
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/dashboard/src/app/(dashboard)/projects/[id]/components/DomainSettings.tsx:445
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/dashboard/src/app/mcp/authorize/page.tsx:63
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/dashboard/src/hooks/useProjectEndpoints.ts:59
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/dashboard/src/lib/api/mail.ts:394
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/dashboard/src/lib/sseClient.ts:90
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/dashboard/src/utils/deploymentPhaseDetector.ts:45
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/email/client/hooks/use-optimistic-actions.ts:118
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/email/client/lib/auth-client.ts:98
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/email/client/lib/email-utils.client.tsx:26
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/email/client/lib/server-tool.ts:5
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/email/client/lib/trpc.ts:15
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/email/client/providers/query-provider.tsx:99
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/email/scripts/slim-engine.ts:140
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/email/server/scripts/fetch-thread-debug.ts:77
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/email/server/src/lib/imap-driver.ts:421
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/email/server/src/trpc/routes/drafts.ts:54
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — apps/web/src/app/(site)/download/page.tsx:110
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — scripts/update-geoip.mjs:27
Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.
runtime safetyRobustness
medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing
AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.
Repo hardeningGenerated repo pattern
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph hardware Supply chain conf 1.00 3 occurrences Docker base image uses a mutable or implicit tag: oven/bun:latest
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
3 files, 3 locations
apps/api/Dockerfile:23
apps/dashboard/Dockerfile:2
apps/web/Dockerfile:2
containersPinned dependencies
medium System graph hardware Security conf 1.00 Dockerfile runs as root: apps/api/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph hardware Security conf 1.00 Dockerfile runs as root: apps/dashboard/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph hardware Security conf 1.00 Dockerfile runs as root: apps/web/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph cicd CI/CD security conf 1.00 2 occurrences GitHub Action is tag-pinned rather than SHA-pinned
actions/checkout@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.
2 files, 2 locations
.github/workflows/ci.yml:14
.github/workflows/release.yml:24
CI/CD securitySupply chainGithub actions
medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions
CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.
.github/workflows/release.yml CI/CD securitySupply chainGithub actions
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in apps/dashboard/src/app/layout.tsx:96
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
apps/dashboard/src/app/layout.tsx:96 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in apps/dashboard/src/components/theme-provider.tsx:126
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
apps/dashboard/src/components/theme-provider.tsx:126 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in apps/email/client/components/ui/chart.tsx:73
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
apps/email/client/components/ui/chart.tsx:73 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in apps/email/client/lib/email-utils.client.tsx:196
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
apps/email/client/lib/email-utils.client.tsx:196 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in apps/email/client/lib/sanitize-tip-tap-html.tsx:17
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
apps/email/client/lib/sanitize-tip-tap-html.tsx:17 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in apps/web/src/app/(site)/(marketing)/mail/page.tsx:71
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
apps/web/src/app/(site)/(marketing)/mail/page.tsx:71 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in apps/web/src/app/(site)/(marketing)/pricing/layout.tsx:115
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
apps/web/src/app/(site)/(marketing)/pricing/layout.tsx:115 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in apps/web/src/app/(site)/download/layout.tsx:75
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
apps/web/src/app/(site)/download/layout.tsx:75 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in apps/web/src/app/(site)/layout.tsx:177
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
apps/web/src/app/(site)/layout.tsx:177 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in apps/web/src/app/(site)/page.tsx:61
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
apps/web/src/app/(site)/page.tsx:61 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in apps/web/src/app/(site)/resources/[...slug]/page.tsx:145
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
apps/web/src/app/(site)/resources/[...slug]/page.tsx:145 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'dangerous_innerhtml' in apps/web/src/app/(site)/resources/page.tsx:127
Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.
apps/web/src/app/(site)/resources/page.tsx:127 Dangerous innerhtml
medium System graph security security conf 0.65 Insecure pattern 'domparser_html_parse' in apps/email/client/lib/email-utils.client.tsx:108
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
apps/email/client/lib/email-utils.client.tsx:108 Domparser html parse
medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected
Found 428 placeholder/mock markers across 130 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.
Mock dataIncompleteGenerated repo pattern
medium System graph security Secrets conf 0.58 Possible secret in apps/dashboard/src/lib/api/endpoints.ts
Detected 1 occurrence(s) matching password_literal. Rotate real credentials and move them to a secret manager.
apps/dashboard/src/lib/api/endpoints.ts:290 Password literal
medium System graph security Secrets conf 0.58 Possible secret in apps/email/engine/tools/create_mail_user_OpenLDAP.sh
Detected 1 occurrence(s) matching password_literal. Rotate real credentials and move them to a secret manager.
apps/email/engine/tools/create_mail_user_OpenLDAP.sh:93 Password literal
medium System graph network Security conf 1.00 Privileged port 1 in use
Port 1 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
apps/email/engine/functions/postgresql.sh Ports
medium System graph network Security conf 1.00 Privileged port 127 in use
Port 127 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
packages/adapters/src/infra/openresty-lua.ts Ports
medium System graph network Security conf 1.00 Privileged port 3 in use
Port 3 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
apps/email/engine/functions/postgresql.sh Ports
medium System graph network Security conf 1.00 Privileged port 465 in use
Port 465 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
apps/web/src/app/(site)/(marketing)/mail/setup-guide/nodemailer/page.tsx Ports
medium System graph network Security conf 1.00 Privileged port 993 in use
Port 993 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.
apps/email/server/scripts/fetch-thread-debug.ts Ports
medium System graph security Semgrep conf 1.00 react dangerouslysetinnerhtml — apps/email/client/lib/email-utils.client.tsx:196
Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your H…
SecurityReact
medium System graph security Secrets conf 0.65 Runtime dotenv file present in repo: apps/email/client/.env.development
`apps/email/client/.env.development` looks like a runtime dotenv file. No high-confidence secret value was matched, but runtime dotenv files often drift into live credentials. Move real values to a secret manager and keep only `.env.example` style templates in source control.
apps/email/client/.env.development ConfigEnv fileRuntime env
medium System graph security Semgrep conf 1.00 use tls — fixtures/deploy/go/main.go:17
Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information. Rule: go.lang.security.audit.net.use-tls.use-tls Severity: WARNING OWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:…
SecurityGo
medium System graph quality Tests conf 1.00 Very low test-to-source ratio
128 test file(s) for 1552 source file(s) (ratio 0.08). Consider adding integration or unit tests for critical paths.
Coverage
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency @hono/node-server 1.19.11: GHSA-92pp-h63x-v22m
OSV.dev reports `@hono/node-server` at version `1.19.11` (resolved in `bun.lock`) is affected by GHSA-92pp-h63x-v22m. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-92pp-h63x-v22m Fix: upgrade `@hono/node-server` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa 92pp h63x v22m
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency @hono/node-server 1.19.11: GHSA-frvp-7c67-39w9
OSV.dev reports `@hono/node-server` at version `1.19.11` (resolved in `bun.lock`) is affected by GHSA-frvp-7c67-39w9. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-frvp-7c67-39w9 Fix: upgrade `@hono/node-server` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa frvp 7c67 39w9
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency @hono/node-server 1.19.9: GHSA-92pp-h63x-v22m
OSV.dev reports `@hono/node-server` at version `1.19.9` (resolved in `bun.lock`) is affected by GHSA-92pp-h63x-v22m. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-92pp-h63x-v22m Fix: upgrade `@hono/node-server` past the affected range per the advisory.
bun.lock ScaOsvGhsa 92pp h63x v22m
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency @hono/node-server 1.19.9: GHSA-frvp-7c67-39w9
OSV.dev reports `@hono/node-server` at version `1.19.9` (resolved in `bun.lock`) is affected by GHSA-frvp-7c67-39w9. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-frvp-7c67-39w9 Fix: upgrade `@hono/node-server` past the affected range per the advisory.
bun.lock ScaOsvGhsa frvp 7c67 39w9
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency @hono/node-server 1.19.9: GHSA-wc8c-qw6v-h7f6
OSV.dev reports `@hono/node-server` at version `1.19.9` (resolved in `bun.lock`) is affected by GHSA-wc8c-qw6v-h7f6. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wc8c-qw6v-h7f6 Fix: upgrade `@hono/node-server` past the affected range per the advisory.
bun.lock ScaOsvGhsa wc8c qw6v h7f6
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency better-auth 1.5.4: GHSA-2vg6-77g8-24mp
OSV.dev reports `better-auth` at version `1.5.4` (resolved in `bun.lock`) is affected by GHSA-2vg6-77g8-24mp. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-2vg6-77g8-24mp Fix: upgrade `better-auth` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa 2vg6 77g8 24mp
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency better-auth 1.5.4: GHSA-392p-2q2v-4372
OSV.dev reports `better-auth` at version `1.5.4` (resolved in `bun.lock`) is affected by GHSA-392p-2q2v-4372. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-392p-2q2v-4372 Fix: upgrade `better-auth` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa 392p 2q2v 4372
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency better-auth 1.5.4: GHSA-7w99-5wm4-3g79
OSV.dev reports `better-auth` at version `1.5.4` (resolved in `bun.lock`) is affected by GHSA-7w99-5wm4-3g79. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-7w99-5wm4-3g79 Fix: upgrade `better-auth` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa 7w99 5wm4 3g79
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency better-auth 1.5.4: GHSA-86j7-9j95-vpqj
OSV.dev reports `better-auth` at version `1.5.4` (resolved in `bun.lock`) is affected by GHSA-86j7-9j95-vpqj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-86j7-9j95-vpqj Fix: upgrade `better-auth` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa 86j7 9j95 vpqj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency better-auth 1.5.4: GHSA-9h47-pqcx-hjr4
OSV.dev reports `better-auth` at version `1.5.4` (resolved in `bun.lock`) is affected by GHSA-9h47-pqcx-hjr4. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-9h47-pqcx-hjr4 Fix: upgrade `better-auth` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa 9h47 pqcx hjr4
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency better-auth 1.5.4: GHSA-fmh4-wcc4-5jm3
OSV.dev reports `better-auth` at version `1.5.4` (resolved in `bun.lock`) is affected by GHSA-fmh4-wcc4-5jm3. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-fmh4-wcc4-5jm3 Fix: upgrade `better-auth` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa fmh4 wcc4 5jm3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency better-auth 1.5.4: GHSA-g38m-r43w-p2q7
OSV.dev reports `better-auth` at version `1.5.4` (resolved in `bun.lock`) is affected by GHSA-g38m-r43w-p2q7. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-g38m-r43w-p2q7 Fix: upgrade `better-auth` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa g38m r43w p2q7
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency better-auth 1.5.4: GHSA-pw9m-5jxm-xr6h
OSV.dev reports `better-auth` at version `1.5.4` (resolved in `bun.lock`) is affected by GHSA-pw9m-5jxm-xr6h. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pw9m-5jxm-xr6h Fix: upgrade `better-auth` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa pw9m 5jxm xr6h
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency better-auth 1.5.4: GHSA-wxw3-q3m9-c3jr
OSV.dev reports `better-auth` at version `1.5.4` (resolved in `bun.lock`) is affected by GHSA-wxw3-q3m9-c3jr. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wxw3-q3m9-c3jr Fix: upgrade `better-auth` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa wxw3 q3m9 c3jr
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency better-auth 1.6.11: GHSA-86j7-9j95-vpqj
OSV.dev reports `better-auth` at version `1.6.11` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-86j7-9j95-vpqj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-86j7-9j95-vpqj Fix: upgrade `better-auth` past the affected range per the advisory.
apps/email/client/package.json ScaOsvGhsa 86j7 9j95 vpqj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.4.5: GHSA-76mc-f452-cxcm
OSV.dev reports `dompurify` at version `3.4.5` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-76mc-f452-cxcm. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-76mc-f452-cxcm Fix: upgrade `dompurify` past the affected range per the advisory.
apps/email/client/package.json ScaOsvGhsa 76mc f452 cxcm
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.4.5: GHSA-c2j3-45gr-mqc4
OSV.dev reports `dompurify` at version `3.4.5` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-c2j3-45gr-mqc4. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-c2j3-45gr-mqc4 Fix: upgrade `dompurify` past the affected range per the advisory.
apps/email/client/package.json ScaOsvGhsa c2j3 45gr mqc4
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.4.5: GHSA-cmwh-pvxp-8882
OSV.dev reports `dompurify` at version `3.4.5` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-cmwh-pvxp-8882. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-cmwh-pvxp-8882 Fix: upgrade `dompurify` past the affected range per the advisory.
apps/email/client/package.json ScaOsvGhsa cmwh pvxp 8882
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.4.5: GHSA-gvmj-g25r-r7wr
OSV.dev reports `dompurify` at version `3.4.5` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-gvmj-g25r-r7wr. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-gvmj-g25r-r7wr Fix: upgrade `dompurify` past the affected range per the advisory.
apps/email/client/package.json ScaOsvGhsa gvmj g25r r7wr
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.4.5: GHSA-hpcv-96wg-7vj8
OSV.dev reports `dompurify` at version `3.4.5` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-hpcv-96wg-7vj8. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-hpcv-96wg-7vj8 Fix: upgrade `dompurify` past the affected range per the advisory.
apps/email/client/package.json ScaOsvGhsa hpcv 96wg 7vj8
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.4.5: GHSA-r47g-fvhr-h676
OSV.dev reports `dompurify` at version `3.4.5` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-r47g-fvhr-h676. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-r47g-fvhr-h676 Fix: upgrade `dompurify` past the affected range per the advisory.
apps/email/client/package.json ScaOsvGhsa r47g fvhr h676
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.4.5: GHSA-rp9w-3fw7-7cwq
OSV.dev reports `dompurify` at version `3.4.5` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-rp9w-3fw7-7cwq. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-rp9w-3fw7-7cwq Fix: upgrade `dompurify` past the affected range per the advisory.
apps/email/client/package.json ScaOsvGhsa rp9w 3fw7 7cwq
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.4.5: GHSA-vxr8-fq34-vvx9
OSV.dev reports `dompurify` at version `3.4.5` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-vxr8-fq34-vvx9. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vxr8-fq34-vvx9 Fix: upgrade `dompurify` past the affected range per the advisory.
apps/email/client/package.json ScaOsvGhsa vxr8 fq34 vvx9
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency dompurify 3.4.5: GHSA-x4vx-rjvf-j5p4
OSV.dev reports `dompurify` at version `3.4.5` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-x4vx-rjvf-j5p4. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-x4vx-rjvf-j5p4 Fix: upgrade `dompurify` past the affected range per the advisory.
apps/email/client/package.json ScaOsvGhsa x4vx rjvf j5p4
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency drizzle-orm 0.45.1: GHSA-gpj5-g38j-94v9
OSV.dev reports `drizzle-orm` at version `0.45.1` (resolved in `bun.lock`) is affected by GHSA-gpj5-g38j-94v9. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-gpj5-g38j-94v9 Fix: upgrade `drizzle-orm` past the affected range per the advisory.
packages/db-email/package.json ScaOsvGhsa gpj5 g38j 94v9
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency electron 40.8.0: GHSA-3c8v-cfp5-9885
OSV.dev reports `electron` at version `40.8.0` (resolved in `bun.lock`) is affected by GHSA-3c8v-cfp5-9885. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-3c8v-cfp5-9885 Fix: upgrade `electron` past the affected range per the advisory.
apps/desktop/package.json ScaOsvGhsa 3c8v cfp5 9885
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency electron 40.8.0: GHSA-4p4r-m79c-wq3v
OSV.dev reports `electron` at version `40.8.0` (resolved in `bun.lock`) is affected by GHSA-4p4r-m79c-wq3v. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-4p4r-m79c-wq3v Fix: upgrade `electron` past the affected range per the advisory.
apps/desktop/package.json ScaOsvGhsa 4p4r m79c wq3v
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency electron 40.8.0: GHSA-8x5q-pvf5-64mp
OSV.dev reports `electron` at version `40.8.0` (resolved in `bun.lock`) is affected by GHSA-8x5q-pvf5-64mp. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-8x5q-pvf5-64mp Fix: upgrade `electron` past the affected range per the advisory.
apps/desktop/package.json ScaOsvGhsa 8x5q pvf5 64mp
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency electron 40.8.0: GHSA-f37v-82c4-4x64
OSV.dev reports `electron` at version `40.8.0` (resolved in `bun.lock`) is affected by GHSA-f37v-82c4-4x64. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-f37v-82c4-4x64 Fix: upgrade `electron` past the affected range per the advisory.
apps/desktop/package.json ScaOsvGhsa f37v 82c4 4x64
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency electron 40.8.0: GHSA-f3pv-wv63-48x8
OSV.dev reports `electron` at version `40.8.0` (resolved in `bun.lock`) is affected by GHSA-f3pv-wv63-48x8. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-f3pv-wv63-48x8 Fix: upgrade `electron` past the affected range per the advisory.
apps/desktop/package.json ScaOsvGhsa f3pv wv63 48x8
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency electron 40.8.0: GHSA-mwmh-mq4g-g6gr
OSV.dev reports `electron` at version `40.8.0` (resolved in `bun.lock`) is affected by GHSA-mwmh-mq4g-g6gr. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-mwmh-mq4g-g6gr Fix: upgrade `electron` past the affected range per the advisory.
apps/desktop/package.json ScaOsvGhsa mwmh mq4g g6gr
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency electron 40.8.0: GHSA-r5p7-gp4j-qhrx
OSV.dev reports `electron` at version `40.8.0` (resolved in `bun.lock`) is affected by GHSA-r5p7-gp4j-qhrx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-r5p7-gp4j-qhrx Fix: upgrade `electron` past the affected range per the advisory.
apps/desktop/package.json ScaOsvGhsa r5p7 gp4j qhrx
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency electron 40.8.0: GHSA-xj5x-m3f3-5x3h
OSV.dev reports `electron` at version `40.8.0` (resolved in `bun.lock`) is affected by GHSA-xj5x-m3f3-5x3h. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xj5x-m3f3-5x3h Fix: upgrade `electron` past the affected range per the advisory.
apps/desktop/package.json ScaOsvGhsa xj5x m3f3 5x3h
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency electron 40.8.0: GHSA-xwr5-m59h-vwqr
OSV.dev reports `electron` at version `40.8.0` (resolved in `bun.lock`) is affected by GHSA-xwr5-m59h-vwqr. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xwr5-m59h-vwqr Fix: upgrade `electron` past the affected range per the advisory.
apps/desktop/package.json ScaOsvGhsa xwr5 m59h vwqr
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency esbuild 0.18.20: GHSA-67mh-4wv8-2f99
OSV.dev reports `esbuild` at version `0.18.20` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-67mh-4wv8-2f99. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-67mh-4wv8-2f99 Fix: upgrade `esbuild` past the affected range per the advisory.
apps/email/client/bun.lock ScaOsvGhsa 67mh 4wv8 2f99
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-26pp-8wgv-hjvm
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-26pp-8wgv-hjvm (aka CVE-2026-56762). Hono missing validation of cookie name on write path in setCookie() Aliases: CVE-2026-56762 Advisory: https://osv.dev/vulnerability/GHSA-26pp-8wgv-hjvm Fix: upgrade `hono` …
bun.lock ScaOsvGhsa 26pp 8wgv hjvm
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-2gcr-mfcq-wcc3
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-2gcr-mfcq-wcc3 (aka CVE-2026-47676). Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths Aliases: CVE-2026-47676 Advisory: https://osv.dev/vulnerabil…
bun.lock ScaOsvGhsa 2gcr mfcq wcc3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-3hrh-pfw6-9m5x
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-3hrh-pfw6-9m5x (aka CVE-2026-47675). Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection Aliases: CVE-2026-47675 Advisory: https://osv.dev/vulnerability/GHSA-3hrh-pfw6-9m…
bun.lock ScaOsvGhsa 3hrh pfw6 9m5x
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-458j-xx4x-4375
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-458j-xx4x-4375 (aka CVE-2026-56761). hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR Aliases: CVE-2026-56761 Advisory: https://osv.dev/vulnerability/GHSA-458j-xx4x-4375 Fix: u…
bun.lock ScaOsvGhsa 458j xx4x 4375
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-5pq2-9x2x-5p6w
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-5pq2-9x2x-5p6w. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-5pq2-9x2x-5p6w Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa 5pq2 9x2x 5p6w
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-69xw-7hcm-h432
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-69xw-7hcm-h432. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-69xw-7hcm-h432 Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa 69xw 7hcm h432
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-6wqw-2p9w-4vw4
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-6wqw-2p9w-4vw4. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-6wqw-2p9w-4vw4 Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa 6wqw 2p9w 4vw4
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-9r54-q6cx-xmh5
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-9r54-q6cx-xmh5. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-9r54-q6cx-xmh5 Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa 9r54 q6cx xmh5
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-9vqf-7f2p-gf9v
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-9vqf-7f2p-gf9v. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-9vqf-7f2p-gf9v Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa 9vqf 7f2p gf9v
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-f577-qrjj-4474
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-f577-qrjj-4474. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-f577-qrjj-4474 Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa f577 qrjj 4474
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-gq3j-xvxp-8hrf
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-gq3j-xvxp-8hrf. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-gq3j-xvxp-8hrf Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa gq3j xvxp 8hrf
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-hm8q-7f3q-5f36
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-hm8q-7f3q-5f36. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-hm8q-7f3q-5f36 Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa hm8q 7f3q 5f36
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-j6c9-x7qj-28xf
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-j6c9-x7qj-28xf (aka CVE-2026-54287). hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice Aliases: CVE-2026-54287 Advisory: https://os…
bun.lock ScaOsvGhsa j6c9 x7qj 28xf
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-p6xx-57qc-3wxr
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-p6xx-57qc-3wxr. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-p6xx-57qc-3wxr Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa p6xx 57qc 3wxr
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-p77w-8qqv-26rm
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-p77w-8qqv-26rm. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-p77w-8qqv-26rm Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa p77w 8qqv 26rm
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-q5qw-h33p-qvwr
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-q5qw-h33p-qvwr. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-q5qw-h33p-qvwr Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa q5qw h33p qvwr
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-qp7p-654g-cw7p
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-qp7p-654g-cw7p. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-qp7p-654g-cw7p Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa qp7p 654g cw7p
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-r354-f388-2fhh
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-r354-f388-2fhh. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-r354-f388-2fhh Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa r354 f388 2fhh
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-r5rp-j6wh-rvv4
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-r5rp-j6wh-rvv4. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-r5rp-j6wh-rvv4 Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa r5rp j6wh rvv4
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-rv63-4mwf-qqc2
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-rv63-4mwf-qqc2 (aka CVE-2026-54288). hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` Aliases: CVE-2026-54288 Advisory: https://osv.dev/vulnerability/GHSA-rv63-4mwf-qq…
bun.lock ScaOsvGhsa rv63 4mwf qqc2
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-v8w9-8mx6-g223
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-v8w9-8mx6-g223. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223 Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa v8w9 8mx6 g223
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-w332-q679-j88p
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-w332-q679-j88p. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-w332-q679-j88p Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa w332 q679 j88p
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-w62v-xxxg-mg59
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-w62v-xxxg-mg59 (aka CVE-2026-59895). Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility Aliases: CVE-2026-59895 Advisory: https://osv.dev/vulnerability/GHSA-w62v-xxxg-mg59 Fix: upgrade `hono` past t…
bun.lock ScaOsvGhsa w62v xxxg mg59
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-wgpf-jwqj-8h8p
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-wgpf-jwqj-8h8p (aka CVE-2026-54289). hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest Aliases: CVE-2026-54289 Advisory: https://osv.dev/vulnerability/GHSA-wgp…
bun.lock ScaOsvGhsa wgpf jwqj 8h8p
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-wmmm-f939-6g9c
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-wmmm-f939-6g9c. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wmmm-f939-6g9c Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa wmmm f939 6g9c
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-wwfh-h76j-fc44
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-wwfh-h76j-fc44 (aka CVE-2026-54286). hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) Aliases: CVE-2026-54286 Advisory: https://osv.dev/vulnerability/GHSA-wwfh-h76j-fc44 Fix: upg…
bun.lock ScaOsvGhsa wwfh h76j fc44
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-xf4j-xp2r-rqqx
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-xf4j-xp2r-rqqx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xf4j-xp2r-rqqx Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa xf4j xp2r rqqx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-xgm2-5f3f-mvvc
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-xgm2-5f3f-mvvc (aka CVE-2026-59897). Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication Aliases: CVE-2026-59897 Advisory: https://osv.dev/vulnerability/GHSA-xg…
bun.lock ScaOsvGhsa xgm2 5f3f mvvc
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-xpcf-pg52-r92g
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-xpcf-pg52-r92g. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xpcf-pg52-r92g Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa xpcf pg52 r92g
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.11.4: GHSA-xrhx-7g5j-rcj5
OSV.dev reports `hono` at version `4.11.4` (resolved in `bun.lock`) is affected by GHSA-xrhx-7g5j-rcj5. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xrhx-7g5j-rcj5 Fix: upgrade `hono` past the affected range per the advisory.
bun.lock ScaOsvGhsa xrhx 7g5j rcj5
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.23: GHSA-hvrm-45r6-mjfj
OSV.dev reports `hono` at version `4.12.23` (resolved in `apps/email/server/bun.lock`) is affected by GHSA-hvrm-45r6-mjfj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-hvrm-45r6-mjfj Fix: upgrade `hono` past the affected range per the advisory.
apps/email/server/package.json ScaOsvGhsa hvrm 45r6 mjfj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.23: GHSA-j6c9-x7qj-28xf
OSV.dev reports `hono` at version `4.12.23` (resolved in `apps/email/server/bun.lock`) is affected by GHSA-j6c9-x7qj-28xf (aka CVE-2026-54287). hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice Aliases: CVE-2026-54287 A…
apps/email/server/package.json ScaOsvGhsa j6c9 x7qj 28xf
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.23: GHSA-rv63-4mwf-qqc2
OSV.dev reports `hono` at version `4.12.23` (resolved in `apps/email/server/bun.lock`) is affected by GHSA-rv63-4mwf-qqc2 (aka CVE-2026-54288). hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` Aliases: CVE-2026-54288 Advisory: https://osv.dev/vulnerabilit…
apps/email/server/package.json ScaOsvGhsa rv63 4mwf qqc2
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.23: GHSA-w62v-xxxg-mg59
OSV.dev reports `hono` at version `4.12.23` (resolved in `apps/email/server/bun.lock`) is affected by GHSA-w62v-xxxg-mg59 (aka CVE-2026-59895). Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility Aliases: CVE-2026-59895 Advisory: https://osv.dev/vulnerability/GHSA-w62v-xxxg-mg59 Fix: up…
apps/email/server/package.json ScaOsvGhsa w62v xxxg mg59
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.23: GHSA-wgpf-jwqj-8h8p
OSV.dev reports `hono` at version `4.12.23` (resolved in `apps/email/server/bun.lock`) is affected by GHSA-wgpf-jwqj-8h8p (aka CVE-2026-54289). hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest Aliases: CVE-2026-54289 Advisory: https://osv.dev/vul…
apps/email/server/package.json ScaOsvGhsa wgpf jwqj 8h8p
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.23: GHSA-wwfh-h76j-fc44
OSV.dev reports `hono` at version `4.12.23` (resolved in `apps/email/server/bun.lock`) is affected by GHSA-wwfh-h76j-fc44 (aka CVE-2026-54286). hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) Aliases: CVE-2026-54286 Advisory: https://osv.dev/vulnerability/GHSA-wwfh…
apps/email/server/package.json ScaOsvGhsa wwfh h76j fc44
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.23: GHSA-xgm2-5f3f-mvvc
OSV.dev reports `hono` at version `4.12.23` (resolved in `apps/email/server/bun.lock`) is affected by GHSA-xgm2-5f3f-mvvc (aka CVE-2026-59897). Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication Aliases: CVE-2026-59897 Advisory: https://osv.dev/vu…
apps/email/server/package.json ScaOsvGhsa xgm2 5f3f mvvc
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-26pp-8wgv-hjvm
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-26pp-8wgv-hjvm (aka CVE-2026-56762). Hono missing validation of cookie name on write path in setCookie() Aliases: CVE-2026-56762 Advisory: https://osv.dev/vulnerability/GHSA-26pp-8wgv-hjvm Fix: upgrade `hono` …
apps/api/package.json ScaOsvGhsa 26pp 8wgv hjvm
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-2gcr-mfcq-wcc3
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-2gcr-mfcq-wcc3 (aka CVE-2026-47676). Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths Aliases: CVE-2026-47676 Advisory: https://osv.dev/vulnerabil…
apps/api/package.json ScaOsvGhsa 2gcr mfcq wcc3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-3hrh-pfw6-9m5x
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-3hrh-pfw6-9m5x (aka CVE-2026-47675). Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection Aliases: CVE-2026-47675 Advisory: https://osv.dev/vulnerability/GHSA-3hrh-pfw6-9m…
apps/api/package.json ScaOsvGhsa 3hrh pfw6 9m5x
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-458j-xx4x-4375
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-458j-xx4x-4375 (aka CVE-2026-56761). hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR Aliases: CVE-2026-56761 Advisory: https://osv.dev/vulnerability/GHSA-458j-xx4x-4375 Fix: u…
apps/api/package.json ScaOsvGhsa 458j xx4x 4375
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-69xw-7hcm-h432
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-69xw-7hcm-h432. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-69xw-7hcm-h432 Fix: upgrade `hono` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa 69xw 7hcm h432
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-9vqf-7f2p-gf9v
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-9vqf-7f2p-gf9v. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-9vqf-7f2p-gf9v Fix: upgrade `hono` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa 9vqf 7f2p gf9v
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-f577-qrjj-4474
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-f577-qrjj-4474. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-f577-qrjj-4474 Fix: upgrade `hono` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa f577 qrjj 4474
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-hm8q-7f3q-5f36
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-hm8q-7f3q-5f36. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-hm8q-7f3q-5f36 Fix: upgrade `hono` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa hm8q 7f3q 5f36
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-hvrm-45r6-mjfj
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-hvrm-45r6-mjfj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-hvrm-45r6-mjfj Fix: upgrade `hono` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa hvrm 45r6 mjfj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-j6c9-x7qj-28xf
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-j6c9-x7qj-28xf (aka CVE-2026-54287). hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice Aliases: CVE-2026-54287 Advisory: https://os…
apps/api/package.json ScaOsvGhsa j6c9 x7qj 28xf
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-p77w-8qqv-26rm
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-p77w-8qqv-26rm. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-p77w-8qqv-26rm Fix: upgrade `hono` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa p77w 8qqv 26rm
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-qp7p-654g-cw7p
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-qp7p-654g-cw7p. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-qp7p-654g-cw7p Fix: upgrade `hono` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa qp7p 654g cw7p
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-r5rp-j6wh-rvv4
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-r5rp-j6wh-rvv4. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-r5rp-j6wh-rvv4 Fix: upgrade `hono` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa r5rp j6wh rvv4
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-rv63-4mwf-qqc2
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-rv63-4mwf-qqc2 (aka CVE-2026-54288). hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` Aliases: CVE-2026-54288 Advisory: https://osv.dev/vulnerability/GHSA-rv63-4mwf-qq…
apps/api/package.json ScaOsvGhsa rv63 4mwf qqc2
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-v8w9-8mx6-g223
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-v8w9-8mx6-g223. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-v8w9-8mx6-g223 Fix: upgrade `hono` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa v8w9 8mx6 g223
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-w62v-xxxg-mg59
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-w62v-xxxg-mg59 (aka CVE-2026-59895). Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility Aliases: CVE-2026-59895 Advisory: https://osv.dev/vulnerability/GHSA-w62v-xxxg-mg59 Fix: upgrade `hono` past t…
apps/api/package.json ScaOsvGhsa w62v xxxg mg59
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-wgpf-jwqj-8h8p
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-wgpf-jwqj-8h8p (aka CVE-2026-54289). hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest Aliases: CVE-2026-54289 Advisory: https://osv.dev/vulnerability/GHSA-wgp…
apps/api/package.json ScaOsvGhsa wgpf jwqj 8h8p
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-wmmm-f939-6g9c
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-wmmm-f939-6g9c. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wmmm-f939-6g9c Fix: upgrade `hono` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa wmmm f939 6g9c
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-wwfh-h76j-fc44
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-wwfh-h76j-fc44 (aka CVE-2026-54286). hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) Aliases: CVE-2026-54286 Advisory: https://osv.dev/vulnerability/GHSA-wwfh-h76j-fc44 Fix: upg…
apps/api/package.json ScaOsvGhsa wwfh h76j fc44
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-xf4j-xp2r-rqqx
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-xf4j-xp2r-rqqx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xf4j-xp2r-rqqx Fix: upgrade `hono` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa xf4j xp2r rqqx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-xgm2-5f3f-mvvc
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-xgm2-5f3f-mvvc (aka CVE-2026-59897). Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication Aliases: CVE-2026-59897 Advisory: https://osv.dev/vulnerability/GHSA-xg…
apps/api/package.json ScaOsvGhsa xgm2 5f3f mvvc
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-xpcf-pg52-r92g
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-xpcf-pg52-r92g. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xpcf-pg52-r92g Fix: upgrade `hono` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa xpcf pg52 r92g
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency hono 4.12.5: GHSA-xrhx-7g5j-rcj5
OSV.dev reports `hono` at version `4.12.5` (resolved in `bun.lock`) is affected by GHSA-xrhx-7g5j-rcj5. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xrhx-7g5j-rcj5 Fix: upgrade `hono` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa xrhx 7g5j rcj5
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-267c-6grr-h53f
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-267c-6grr-h53f. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-267c-6grr-h53f Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa 267c 6grr h53f
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-26hh-7cqf-hhc6
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-26hh-7cqf-hhc6. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-26hh-7cqf-hhc6 Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa 26hh 7cqf hhc6
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-36qx-fr4f-26g5
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-36qx-fr4f-26g5. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-36qx-fr4f-26g5 Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa 36qx fr4f 26g5
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-3g8h-86w9-wvmq
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-3g8h-86w9-wvmq. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-3g8h-86w9-wvmq Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa 3g8h 86w9 wvmq
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-3x4c-7xq6-9pq8
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-3x4c-7xq6-9pq8. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-3x4c-7xq6-9pq8 Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa 3x4c 7xq6 9pq8
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-4633-3j49-mh5q
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-4633-3j49-mh5q. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-4633-3j49-mh5q Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa 4633 3j49 mh5q
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-492v-c6pp-mqqv
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-492v-c6pp-mqqv. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-492v-c6pp-mqqv Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa 492v c6pp mqqv
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-4c39-4ccg-62r3
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-4c39-4ccg-62r3. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-4c39-4ccg-62r3 Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa 4c39 4ccg 62r3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-68g3-v927-f742
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-68g3-v927-f742. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-68g3-v927-f742 Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa 68g3 v927 f742
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-6gpp-xcg3-4w24
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-6gpp-xcg3-4w24. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-6gpp-xcg3-4w24 Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa 6gpp xcg3 4w24
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-89xv-2m56-2m9x
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-89xv-2m56-2m9x. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-89xv-2m56-2m9x Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa 89xv 2m56 2m9x
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-8h8q-6873-q5fj
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-8h8q-6873-q5fj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-8h8q-6873-q5fj Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa 8h8q 6873 q5fj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-955p-x3mx-jcvp
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-955p-x3mx-jcvp. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-955p-x3mx-jcvp Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa 955p x3mx jcvp
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-c4j6-fc7j-m34r
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-c4j6-fc7j-m34r. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-c4j6-fc7j-m34r Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa c4j6 fc7j m34r
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-ffhc-5mcf-pf4q
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-ffhc-5mcf-pf4q. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-ffhc-5mcf-pf4q Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa ffhc 5mcf pf4q
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-ggv3-7p47-pfv8
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-ggv3-7p47-pfv8. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-ggv3-7p47-pfv8 Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa ggv3 7p47 pfv8
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-gx5p-jg67-6x7h
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-gx5p-jg67-6x7h. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-gx5p-jg67-6x7h Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa gx5p jg67 6x7h
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-h27x-g6w4-24gq
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-h27x-g6w4-24gq. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h27x-g6w4-24gq Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa h27x g6w4 24gq
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-h64f-5h5j-jqjh
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-h64f-5h5j-jqjh. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h64f-5h5j-jqjh Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa h64f 5h5j jqjh
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-jcc7-9wpm-mj36
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-jcc7-9wpm-mj36. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jcc7-9wpm-mj36 Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa jcc7 9wpm mj36
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-m99w-x7hq-7vfj
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-m99w-x7hq-7vfj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-m99w-x7hq-7vfj Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa m99w x7hq 7vfj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-mg66-mrh9-m8jx
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-mg66-mrh9-m8jx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-mg66-mrh9-m8jx Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa mg66 mrh9 m8jx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-mq59-m269-xvcx
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-mq59-m269-xvcx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-mq59-m269-xvcx Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa mq59 m269 xvcx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-p9j2-gv94-2wf4
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-p9j2-gv94-2wf4. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-p9j2-gv94-2wf4 Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa p9j2 gv94 2wf4
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-q4gf-8mx6-v5v3
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-q4gf-8mx6-v5v3. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-q4gf-8mx6-v5v3 Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa q4gf 8mx6 v5v3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-q8wf-6r8g-63ch
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-q8wf-6r8g-63ch. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-q8wf-6r8g-63ch Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa q8wf 6r8g 63ch
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-vfv6-92ff-j949
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-vfv6-92ff-j949. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vfv6-92ff-j949 Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa vfv6 92ff j949
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency next 16.1.6: GHSA-wfc6-r584-vfw7
OSV.dev reports `next` at version `16.1.6` (resolved in `bun.lock`) is affected by GHSA-wfc6-r584-vfw7. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wfc6-r584-vfw7 Fix: upgrade `next` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa wfc6 r584 vfw7
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.10.1: GHSA-268h-hp4c-crq3
OSV.dev reports `nodemailer` at version `6.10.1` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-268h-hp4c-crq3. Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection Advisory: https://osv.dev/vulnerability/GHSA-268h-hp4c-crq3 Fix…
apps/email/client/bun.lock ScaOsvGhsa 268h hp4c crq3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.10.1: GHSA-c7w3-x93f-qmm8
OSV.dev reports `nodemailer` at version `6.10.1` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-c7w3-x93f-qmm8. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-c7w3-x93f-qmm8 Fix: upgrade `nodemailer` past the affected range per the advisory.
apps/email/client/bun.lock ScaOsvGhsa c7w3 x93f qmm8
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.10.1: GHSA-mm7p-fcc7-pg87
OSV.dev reports `nodemailer` at version `6.10.1` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-mm7p-fcc7-pg87. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-mm7p-fcc7-pg87 Fix: upgrade `nodemailer` past the affected range per the advisory.
apps/email/client/bun.lock ScaOsvGhsa mm7p fcc7 pg87
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.10.1: GHSA-r7g4-qg5f-qqm2
OSV.dev reports `nodemailer` at version `6.10.1` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-r7g4-qg5f-qqm2. Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception Advisory: https://osv.dev/vulnerability/GHSA-r7g4-qg5f-qqm2 Fix: up…
apps/email/client/bun.lock ScaOsvGhsa r7g4 qg5f qqm2
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.10.1: GHSA-rcmh-qjqh-p98v
OSV.dev reports `nodemailer` at version `6.10.1` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-rcmh-qjqh-p98v. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-rcmh-qjqh-p98v Fix: upgrade `nodemailer` past the affected range per the advisory.
apps/email/client/bun.lock ScaOsvGhsa rcmh qjqh p98v
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.10.1: GHSA-vvjj-xcjg-gr5g
OSV.dev reports `nodemailer` at version `6.10.1` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-vvjj-xcjg-gr5g. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vvjj-xcjg-gr5g Fix: upgrade `nodemailer` past the affected range per the advisory.
apps/email/client/bun.lock ScaOsvGhsa vvjj xcjg gr5g
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.10.1: GHSA-wqvq-jvpq-h66f
OSV.dev reports `nodemailer` at version `6.10.1` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-wqvq-jvpq-h66f. Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization Advisory: https://osv.dev/vulnerability/GHSA-wqvq-jvpq-h66f Fix: up…
apps/email/client/bun.lock ScaOsvGhsa wqvq jvpq h66f
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 8.0.5: GHSA-268h-hp4c-crq3
OSV.dev reports `nodemailer` at version `8.0.5` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-268h-hp4c-crq3. Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection Advisory: https://osv.dev/vulnerability/GHSA-268h-hp4c-crq3 Fix:…
apps/email/client/bun.lock ScaOsvGhsa 268h hp4c crq3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 8.0.5: GHSA-r7g4-qg5f-qqm2
OSV.dev reports `nodemailer` at version `8.0.5` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-r7g4-qg5f-qqm2. Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception Advisory: https://osv.dev/vulnerability/GHSA-r7g4-qg5f-qqm2 Fix: upg…
apps/email/client/bun.lock ScaOsvGhsa r7g4 qg5f qqm2
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 8.0.5: GHSA-wqvq-jvpq-h66f
OSV.dev reports `nodemailer` at version `8.0.5` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-wqvq-jvpq-h66f. Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization Advisory: https://osv.dev/vulnerability/GHSA-wqvq-jvpq-h66f Fix: upg…
apps/email/client/bun.lock ScaOsvGhsa wqvq jvpq h66f
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 8.0.7: GHSA-268h-hp4c-crq3
OSV.dev reports `nodemailer` at version `8.0.7` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-268h-hp4c-crq3. Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection Advisory: https://osv.dev/vulnerability/GHSA-268h-hp4c-crq3 Fix:…
apps/email/client/bun.lock ScaOsvGhsa 268h hp4c crq3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 8.0.7: GHSA-r7g4-qg5f-qqm2
OSV.dev reports `nodemailer` at version `8.0.7` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-r7g4-qg5f-qqm2. Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception Advisory: https://osv.dev/vulnerability/GHSA-r7g4-qg5f-qqm2 Fix: upg…
apps/email/client/bun.lock ScaOsvGhsa r7g4 qg5f qqm2
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 8.0.7: GHSA-wqvq-jvpq-h66f
OSV.dev reports `nodemailer` at version `8.0.7` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-wqvq-jvpq-h66f. Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization Advisory: https://osv.dev/vulnerability/GHSA-wqvq-jvpq-h66f Fix: upg…
apps/email/client/bun.lock ScaOsvGhsa wqvq jvpq h66f
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency postcss 8.4.31: GHSA-qx2v-qp2m-jg93
OSV.dev reports `postcss` at version `8.4.31` (resolved in `bun.lock`) is affected by GHSA-qx2v-qp2m-jg93. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-qx2v-qp2m-jg93 Fix: upgrade `postcss` past the affected range per the advisory.
bun.lock ScaOsvGhsa qx2v qp2m jg93
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency postcss 8.5.8: GHSA-qx2v-qp2m-jg93
OSV.dev reports `postcss` at version `8.5.8` (resolved in `bun.lock`) is affected by GHSA-qx2v-qp2m-jg93. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-qx2v-qp2m-jg93 Fix: upgrade `postcss` past the affected range per the advisory.
apps/dashboard/package.json ScaOsvGhsa qx2v qp2m jg93
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency tokio 1: GHSA-2grh-hm3w-w7hv
OSV.dev reports `tokio` at version `1` (declared in `fixtures/deploy/rust-axum/Cargo.toml`) is affected by GHSA-2grh-hm3w-w7hv. Note: `1` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-2grh-hm3w-w7hv Fi…
fixtures/deploy/rust-axum/Cargo.toml ScaOsvGhsa 2grh hm3w w7hv
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency tokio 1: GHSA-4q83-7cq4-p6wg
OSV.dev reports `tokio` at version `1` (declared in `fixtures/deploy/rust-axum/Cargo.toml`) is affected by GHSA-4q83-7cq4-p6wg. Note: `1` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-4q83-7cq4-p6wg Fi…
fixtures/deploy/rust-axum/Cargo.toml ScaOsvGhsa 4q83 7cq4 p6wg
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency tokio 1: GHSA-fg7r-2g4j-5cgr
OSV.dev reports `tokio` at version `1` (declared in `fixtures/deploy/rust-axum/Cargo.toml`) is affected by GHSA-fg7r-2g4j-5cgr. Note: `1` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-fg7r-2g4j-5cgr Fi…
fixtures/deploy/rust-axum/Cargo.toml ScaOsvGhsa fg7r 2g4j 5cgr
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency tokio 1: GHSA-rr8g-9fpq-6wmg
OSV.dev reports `tokio` at version `1` (declared in `fixtures/deploy/rust-axum/Cargo.toml`) is affected by GHSA-rr8g-9fpq-6wmg. Note: `1` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-rr8g-9fpq-6wmg Fi…
fixtures/deploy/rust-axum/Cargo.toml ScaOsvGhsa rr8g 9fpq 6wmg
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency tokio 1: RUSTSEC-2021-0072
OSV.dev reports `tokio` at version `1` (declared in `fixtures/deploy/rust-axum/Cargo.toml`) is affected by RUSTSEC-2021-0072. Note: `1` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2021-0072 Fix: u…
fixtures/deploy/rust-axum/Cargo.toml ScaOsvRustsec 2021 0072
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency tokio 1: RUSTSEC-2021-0124
OSV.dev reports `tokio` at version `1` (declared in `fixtures/deploy/rust-axum/Cargo.toml`) is affected by RUSTSEC-2021-0124. Note: `1` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2021-0124 Fix: u…
fixtures/deploy/rust-axum/Cargo.toml ScaOsvRustsec 2021 0124
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency tokio 1: RUSTSEC-2023-0005
OSV.dev reports `tokio` at version `1` (declared in `fixtures/deploy/rust-axum/Cargo.toml`) is affected by RUSTSEC-2023-0005. Note: `1` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2023-0005 Fix: u…
fixtures/deploy/rust-axum/Cargo.toml ScaOsvRustsec 2023 0005
medium System graph dependencies dependencies conf 0.70 Vulnerable dependency tokio 1: RUSTSEC-2025-0023
OSV.dev reports `tokio` at version `1` (declared in `fixtures/deploy/rust-axum/Cargo.toml`) is affected by RUSTSEC-2025-0023. Note: `1` is the declared floor of a range — the installed version may be newer. No summary published yet. Advisory: https://osv.dev/vulnerability/RUSTSEC-2025-0023 Fix: u…
fixtures/deploy/rust-axum/Cargo.toml ScaOsvRustsec 2025 0023
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency turbo 2.8.14: GHSA-3qcw-2rhx-2726
OSV.dev reports `turbo` at version `2.8.14` (resolved in `bun.lock`) is affected by GHSA-3qcw-2rhx-2726. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-3qcw-2rhx-2726 Fix: upgrade `turbo` past the affected range per the advisory.
package.json ScaOsvGhsa 3qcw 2rhx 2726
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency turbo 2.8.14: GHSA-hcf7-66rw-9f5r
OSV.dev reports `turbo` at version `2.8.14` (resolved in `bun.lock`) is affected by GHSA-hcf7-66rw-9f5r. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-hcf7-66rw-9f5r Fix: upgrade `turbo` past the affected range per the advisory.
package.json ScaOsvGhsa hcf7 66rw 9f5r
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency vite 6.4.2: GHSA-fx2h-pf6j-xcff
OSV.dev reports `vite` at version `6.4.2` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-fx2h-pf6j-xcff. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff Fix: upgrade `vite` past the affected range per the advisory.
apps/email/client/package.json ScaOsvGhsa fx2h pf6j xcff
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency vite 6.4.2: GHSA-v6wh-96g9-6wx3
OSV.dev reports `vite` at version `6.4.2` (resolved in `apps/email/client/bun.lock`) is affected by GHSA-v6wh-96g9-6wx3. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3 Fix: upgrade `vite` past the affected range per the advisory.
apps/email/client/package.json ScaOsvGhsa v6wh 96g9 6wx3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency vite 7.3.1: GHSA-4w7w-66w2-5vf9
OSV.dev reports `vite` at version `7.3.1` (resolved in `bun.lock`) is affected by GHSA-4w7w-66w2-5vf9. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-4w7w-66w2-5vf9 Fix: upgrade `vite` past the affected range per the advisory.
bun.lock ScaOsvGhsa 4w7w 66w2 5vf9
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency vite 7.3.1: GHSA-fx2h-pf6j-xcff
OSV.dev reports `vite` at version `7.3.1` (resolved in `bun.lock`) is affected by GHSA-fx2h-pf6j-xcff. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff Fix: upgrade `vite` past the affected range per the advisory.
bun.lock ScaOsvGhsa fx2h pf6j xcff
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency vite 7.3.1: GHSA-p9ff-h696-f583
OSV.dev reports `vite` at version `7.3.1` (resolved in `bun.lock`) is affected by GHSA-p9ff-h696-f583. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-p9ff-h696-f583 Fix: upgrade `vite` past the affected range per the advisory.
bun.lock ScaOsvGhsa p9ff h696 f583
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency vite 7.3.1: GHSA-v2wj-q39q-566r
OSV.dev reports `vite` at version `7.3.1` (resolved in `bun.lock`) is affected by GHSA-v2wj-q39q-566r. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-v2wj-q39q-566r Fix: upgrade `vite` past the affected range per the advisory.
bun.lock ScaOsvGhsa v2wj q39q 566r
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency vite 7.3.1: GHSA-v6wh-96g9-6wx3
OSV.dev reports `vite` at version `7.3.1` (resolved in `bun.lock`) is affected by GHSA-v6wh-96g9-6wx3. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-v6wh-96g9-6wx3 Fix: upgrade `vite` past the affected range per the advisory.
bun.lock ScaOsvGhsa v6wh 96g9 6wx3
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency vitest 4.0.18: GHSA-5xrq-8626-4rwp
OSV.dev reports `vitest` at version `4.0.18` (resolved in `bun.lock`) is affected by GHSA-5xrq-8626-4rwp. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-5xrq-8626-4rwp Fix: upgrade `vitest` past the affected range per the advisory.
apps/api/package.json ScaOsvGhsa 5xrq 8626 4rwp
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency yaml 1.10.2: GHSA-48c2-rrv3-qjmp
OSV.dev reports `yaml` at version `1.10.2` (resolved in `bun.lock`) is affected by GHSA-48c2-rrv3-qjmp (aka CVE-2026-33532). yaml is vulnerable to Stack Overflow via deeply nested YAML collections Aliases: CVE-2026-33532 Advisory: https://osv.dev/vulnerability/GHSA-48c2-rrv3-qjmp Fix: upgrade `ya…
bun.lock ScaOsvGhsa 48c2 rrv3 qjmp
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency yaml 2.8.2: GHSA-48c2-rrv3-qjmp
OSV.dev reports `yaml` at version `2.8.2` (resolved in `bun.lock`) is affected by GHSA-48c2-rrv3-qjmp (aka CVE-2026-33532). yaml is vulnerable to Stack Overflow via deeply nested YAML collections Aliases: CVE-2026-33532 Advisory: https://osv.dev/vulnerability/GHSA-48c2-rrv3-qjmp Fix: upgrade `yam…
apps/api/package.json ScaOsvGhsa 48c2 rrv3 qjmp
low System graph frontend Frontend quality conf 1.00 "active" state uses light bg in a dark theme — apps/web/src/app/(site)/(marketing)/mail/_components/ui/tabs.tsx:52
A ternary like `active ? 'bg-white' : '...'` (or bg-gray-100/200) on a dark theme produces jarring white pills. Use a dark-emphasized active state instead — border + ring or slightly brighter dark bg. Example: `active ? 'bg-gray-800 border-gray-500 ring-1 ring-blue-500/30' : '…'`. Why: P-E in CHEC…
Fq active light bg
low System graph quality Integrity conf 1.00 85 env vars used in code but missing from .env.example
Drift between code and config docs. The first few: `API_PORT`, `APPIMAGE`, `APPLE_IDENTITY`, `BILLING_TEARDOWN_DELETE_CUSTOMER`, `BILLING_WEBHOOK_DISCARD_UNHANDLED`, `CLIENT_BUILD_DIR`, `DASHBOARD_PORT`, `DEFAULT_IMAP_HOST` + 77 more. Add them (with a placeholder/comment) to .env.example so onboard…
config drift
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 309 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph dependencies dependencies conf 0.90 Dependency @clack/prompts is a major version behind
`@clack/prompts` is pinned at `0.11.0` in `apps/cli/package.json` while the latest release on the npm registry is `1.7.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@clack/prompts`…
apps/cli/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency @hono/node-server is a major version behind
`@hono/node-server` is pinned at `1.19.11` in `apps/api/package.json` while the latest release on the npm registry is `2.0.11` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@hono/node…
apps/api/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency @hono/typebox-validator is a major version behind
`@hono/typebox-validator` is pinned at `0.3.0` in `apps/api/package.json` while the latest release on the npm registry is `1.1.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@hono/t…
apps/api/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency @hookform/resolvers is a major version behind
`@hookform/resolvers` is pinned at `4.1.2` in `apps/email/client/package.json` while the latest release on the npm registry is `5.4.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@h…
apps/email/client/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency @react-email/components is a major version behind
`@react-email/components` is pinned at `0.0.36` in `apps/email/client/package.json` while the latest release on the npm registry is `1.0.12` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgra…
apps/email/client/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency @react-email/render is a major version behind
`@react-email/render` is pinned at `1.1.0` in `apps/email/client/package.json` while the latest release on the npm registry is `2.1.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@r…
apps/email/client/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency @react-router/dev is a major version behind
`@react-router/dev` is pinned at `7.6.1` in `apps/email/client/package.json` while the latest release on the npm registry is `8.3.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@rea…
apps/email/client/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency @tiptap/core is a major version behind
`@tiptap/core` is pinned at `2.23.0` in `apps/email/client/package.json` while the latest release on the npm registry is `3.28.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@tiptap…
apps/email/client/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency @tiptap/extension-bold is a major version behind
`@tiptap/extension-bold` is pinned at `2.23.0` in `apps/email/client/package.json` while the latest release on the npm registry is `3.28.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrad…
apps/email/client/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency @tiptap/extension-document is a major version behind
`@tiptap/extension-document` is pinned at `2.23.0` in `apps/email/client/package.json` while the latest release on the npm registry is `3.28.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and up…
apps/email/client/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency @tiptap/extension-emoji is a major version behind
`@tiptap/extension-emoji` is pinned at `2.23.1` in `apps/email/client/package.json` while the latest release on the npm registry is `3.28.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgra…
apps/email/client/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency @tiptap/extension-file-handler is a major version behind
`@tiptap/extension-file-handler` is pinned at `2.23.0` in `apps/email/client/package.json` while the latest release on the npm registry is `3.28.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide an…
apps/email/client/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency @tiptap/extension-image is a major version behind
`@tiptap/extension-image` is pinned at `2.23.0` in `apps/email/client/package.json` while the latest release on the npm registry is `3.28.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgra…
apps/email/client/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency @tiptap/extension-link is a major version behind
`@tiptap/extension-link` is pinned at `2.23.0` in `apps/email/client/package.json` while the latest release on the npm registry is `3.28.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrad…
apps/email/client/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency @tiptap/extension-paragraph is a major version behind
`@tiptap/extension-paragraph` is pinned at `2.23.0` in `apps/email/client/package.json` while the latest release on the npm registry is `3.28.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and u…
apps/email/client/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency @tiptap/extension-placeholder is a major version behind
`@tiptap/extension-placeholder` is pinned at `2.23.0` in `apps/email/client/package.json` while the latest release on the npm registry is `3.28.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and…
apps/email/client/package.json FreshnessOutdated
low System graph dependencies dependencies conf 0.90 Dependency @tiptap/extension-text is a major version behind
`@tiptap/extension-text` is pinned at `2.23.0` in `apps/email/client/package.json` while the latest release on the npm registry is `3.28.0` — 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrad…
apps/email/client/package.json FreshnessOutdated
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:22-alpine
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
apps/dashboard/Dockerfile:18 containersPinned dependencies
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:22-alpine
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
apps/web/Dockerfile:14 containersPinned dependencies
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: oven/bun:1.3.10
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
apps/api/Dockerfile:4 containersPinned dependencies
low System graph dependencies dependencies conf 1.00 Node manifest has dependencies but no lockfile: apps/api/package.json
`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely.
apps/api/package.json LockfileReproducibilityGenerated repo pattern

Showing first 300 of 462. Refine filters or use the findings page for deep search.

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/107c4468-b9ff-4420-b3ba-7cafb8eb37e7/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/107c4468-b9ff-4420-b3ba-7cafb8eb37e7/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.