a public repository, read by nittim
charmbracelet/vhs security audit
What nittim read in this repository, and what it found. Public repository, public reading — sourced from its own code and dependency manifests, nothing else.
Your CLI home video recorder 📼
Go · 21.2k stars · last push October 1, 2026
charmbracelet/vhs is a command-line tool written in Go that records terminal sessions as video files. The repository provides functionality for capturing and replaying terminal interactions, making it useful for creating demonstrations and documentation of command-line workflows.
The scan of charmbracelet/vhs read 89 files and found evidence of concern. One vulnerable runtime dependency was identified during the analysis. The package github.com/charmbracelet/wish carries advisory GHSA-xjvp-7243-rg9h.
To address this finding, the repository maintainers should update the vulnerable dependency and then rescan charmbracelet/vhs to confirm the issue is resolved. Running a full audit will provide detailed information about the advisory and help determine what action is needed.
Written from nittim's own scan on November 1, 2026; rescanned when the repository changes.
No verdict. The rule-based check reports hard evidence, or reports that it found none. Neither is a judgment on whether this code is safe to ship.
What was read — rule-based scan
Rule-based checks run on nittim's servers — a secret scanner and a dependency check, no model in the path. The code reached those two and stopped there.
Read 89 of 89 eligible files. Commit 24fa225. 2026-11-01.
What the scanners found
- Committed secrets on production paths
- 0
- Vulnerable runtime dependencies
- 1
github.com/charmbracelet/wish (GHSA-xjvp-7243-rg9h)
Run it yourself
Scan any public repository in seconds — no sign-in, no card. Audit it to have a model read the code. Loop the report into your assistant to get the fixes applied and re-checked.
Scan your own repoQuestions
- What did nittim read in charmbracelet/vhs?
- nittim read 89 of 89 eligible files in charmbracelet/vhs. The reading ran on November 1, 2026. It was taken at commit 24fa225.
- Did nittim find committed secrets or vulnerable dependencies in charmbracelet/vhs?
- The rule-based scan found 0 committed secrets and 1 vulnerable dependency in charmbracelet/vhs. Affected: github.com/charmbracelet/wish (GHSA-xjvp-7243-rg9h).
- Is charmbracelet/vhs production ready?
- A free scan is not a verdict. A full audit gives one.
More like this
Add the badge to your README
[](https://nittim.com/library/charmbracelet/vhs)