a public repository, read by nittim
Is avikalpg/byok-relay production ready?
What nittim read in this repository, and what it found. Public repository, public reading — sourced from its own code and dependency manifests, nothing else.
Bring your own key (BYOK) relay to enable lightweight frontend-only apps to use LLMs using the user's API keys without hitting CORS.
JavaScript · 55 stars · last push September 20, 2026
avikalpg/byok-relay is a JavaScript repository that provides a relay service enabling frontend applications to use language model APIs through user-supplied keys while avoiding cross-origin restrictions. The project allows developers to build lightweight applications that delegate API calls without exposing credentials to browser limitations.
Nittim scanned 185 files in avikalpg/byok-relay and found evidence of concern. The scan identified 6 committed credentials on production paths and 13 vulnerable runtime dependencies. Five packages contain known vulnerabilities: @modelcontextprotocol/sdk with GHSA-22jm-h49p-29qw and GHSA-46jr-4wx8-v453, @vue/server-renderer with GHSA-g2v6-rqmx-r4w6, fast-uri with GHSA-4c8g-83qw-93j6, GHSA-5jgf-p345-68v8, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, and GHSA-fph4-wmhf-6fwf, proxy-addr with GHSA-jqcg-44mw-7w3h, and source-map-js with GHSA-68fv-2mgg-jv7q.
Developers should address the committed credentials immediately and update the vulnerable dependencies to patched versions. After making these changes, rescan the repository to confirm the issues are resolved. Running a full audit will provide detailed guidance on each vulnerability and help prioritize remediation efforts.
Written from nittim's own scan on October 23, 2026; rescanned when the repository changes.
No verdict. The rule-based check reports hard evidence, or reports that it found none. Neither is a judgment on whether this code is safe to ship.
What was read — rule-based scan
Rule-based checks run on nittim's servers — a secret scanner and a dependency check, no model in the path. The code reached those two and stopped there.
Read 185 of 185 eligible files. Commit b072407. 2026-10-23.
What the scanners found
- Committed secrets on production paths
- 6
- Vulnerable runtime dependencies
- 13
@modelcontextprotocol/sdk (GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453), @vue/server-renderer (GHSA-g2v6-rqmx-r4w6), fast-uri (GHSA-4c8g-83qw-93j6, GHSA-5jgf-p345-68v8, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf), proxy-addr (GHSA-jqcg-44mw-7w3h), source-map-js (GHSA-68fv-2mgg-jv7q)
Run it yourself
Scan any public repository in seconds — no sign-in, no card. Audit it to have a model read the code. Loop the report into your assistant to get the fixes applied and re-checked.
Scan your own repoQuestions
- What did nittim read in avikalpg/byok-relay?
- nittim read 185 of 185 eligible files in avikalpg/byok-relay. The reading ran on October 23, 2026. It was taken at commit b072407.
- Did nittim find committed secrets or vulnerable dependencies in avikalpg/byok-relay?
- The rule-based scan found 6 committed secrets and 13 vulnerable dependencies in avikalpg/byok-relay. Affected: @modelcontextprotocol/sdk (GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453), @vue/server-renderer (GHSA-g2v6-rqmx-r4w6), fast-uri (GHSA-4c8g-83qw-93j6, GHSA-5jgf-p345-68v8, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf), proxy-addr (GHSA-jqcg-44mw-7w3h), source-map-js (GHSA-68fv-2mgg-jv7q).
- Is avikalpg/byok-relay production ready?
- A free scan is not a verdict. A full audit gives one.
More like this
More JavaScript repositories →
Add the badge to your README
[](https://nittim.com/library/avikalpg/byok-relay)