a public repository, read by nittim
casey/just security audit
What nittim read in this repository, and what it found. Public repository, public reading — sourced from its own code and dependency manifests, nothing else.
🤖 Just a command runner
Rust · 36.5k stars · last push October 27, 2026
casey/just is a command runner written in Rust. The project provides a way to run tasks and commands with a simple interface for developers who need to automate workflows and job execution.
Nittim scanned 298 of 299 files in the repository and found evidence of concern. One vulnerable runtime dependency was detected. The vulnerable package pulldown-cmark has an advisory RUSTSEC-2026-0414.
Developers should rescan casey/just after addressing the vulnerable dependency to confirm the issue is resolved. Running an audit will provide detailed information about the advisory and help determine what action is needed to remediate the finding.
Written from nittim's own scan on October 30, 2026; rescanned when the repository changes.
No verdict. The rule-based check reports hard evidence, or reports that it found none. Neither is a judgment on whether this code is safe to ship.
What was read — rule-based scan
Rule-based checks run on nittim's servers — a secret scanner and a dependency check, no model in the path. The code reached those two and stopped there.
Read 298 of 299 eligible files. Commit c7317c8. 2026-10-30.
What the scanners found
- Committed secrets on production paths
- 0
- Vulnerable runtime dependencies
- 1
pulldown-cmark (RUSTSEC-2026-0414)
Run it yourself
Scan any public repository in seconds — no sign-in, no card. Audit it to have a model read the code. Loop the report into your assistant to get the fixes applied and re-checked.
Scan your own repoQuestions
- What did nittim read in casey/just?
- nittim read 298 of 299 eligible files in casey/just. The reading ran on October 30, 2026. It was taken at commit c7317c8.
- Did nittim find committed secrets or vulnerable dependencies in casey/just?
- The rule-based scan found 0 committed secrets and 1 vulnerable dependency in casey/just. Affected: pulldown-cmark (RUSTSEC-2026-0414).
- Is casey/just production ready?
- A free scan is not a verdict. A full audit gives one.
More like this
Add the badge to your README
[](https://nittim.com/library/casey/just)