What did nittim read in adguardteam/adguardhome?

nittim read 1663 of 1663 eligible files in adguardteam/adguardhome. The reading ran on October 16, 2026. It was taken at commit fc30c3d.

Did nittim find committed secrets or vulnerable dependencies in adguardteam/adguardhome?

The rule-based scan found 1 committed secret and 6 vulnerable dependencies in adguardteam/adguardhome. Affected: js-yaml (GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj), nanoid (GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w).

← Browse the report library

a public repository, read by nittim

Is adguardteam/adguardhome production ready?

What nittim read in this repository, and what it found. Public repository, public reading — sourced from its own code and dependency manifests, nothing else.

Network-wide ads & trackers blocking DNS server

TypeScript · 37.5k stars · last push October 15, 2026

adguardteam/adguardhome is a network-wide DNS server written in TypeScript that blocks advertisements and trackers. The repository provides a centralized solution for filtering unwanted content across all devices on a network by intercepting and managing DNS queries.

Nittim scanned 1663 files in adguardteam/adguardhome and found evidence of security concerns. The scan identified 1 committed credential on a production path and 6 vulnerable runtime dependencies. Two packages contained multiple known vulnerabilities: js-yaml with GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, and GHSA-5p4m-2wfm-xmqj, and nanoid with GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, and GHSA-xwg4-73v4-xw9w.

Developers should update the vulnerable dependencies to patched versions and remove the committed credential from production paths. After making these fixes, rescan the repository to confirm the issues are resolved. Running a full audit will provide detailed remediation guidance for each vulnerability.

Written from nittim's own scan on October 16, 2026; rescanned when the repository changes.

No verdict. The rule-based check reports hard evidence, or reports that it found none. Neither is a judgment on whether this code is safe to ship.

What was read — rule-based scan

Rule-based checks run on nittim's servers — a secret scanner and a dependency check, no model in the path. The code reached those two and stopped there.

Read 1663 of 1663 eligible files. Commit fc30c3d. 2026-10-16.

What the scanners found

Committed secrets on production paths: 1
Vulnerable runtime dependencies: 6

js-yaml (GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj), nanoid (GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w)

Run it yourself

Scan any public repository in seconds — no sign-in, no card. Audit it to have a model read the code. Loop the report into your assistant to get the fixes applied and re-checked.

Scan your own repo

Questions

What did nittim read in adguardteam/adguardhome?: nittim read 1663 of 1663 eligible files in adguardteam/adguardhome. The reading ran on October 16, 2026. It was taken at commit fc30c3d.
Did nittim find committed secrets or vulnerable dependencies in adguardteam/adguardhome?: The rule-based scan found 1 committed secret and 6 vulnerable dependencies in adguardteam/adguardhome. Affected: js-yaml (GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj), nanoid (GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w).
Is adguardteam/adguardhome production ready?: A free scan is not a verdict. A full audit gives one.

Is adguardteam/adguardhome production ready?

What was read — rule-based scan

What the scanners found

Run it yourself

Questions

More like this