← Browse the report library

a public repository, read by nittim

ChatGPTNextWeb/NextChat security audit

What nittim read in this repository, and what it found. Public repository, public reading — sourced from its own code and dependency manifests, nothing else.

✨ Zero-config AI chat assistant. No API key needed — sign up and instantly chat with GPT-5, Claude 4, Gemini 2.5, DeepSeek & 100+ top models. Pay-as-you-go saves you more. Available on Web, iOS, macO…

TypeScript · 88.9k stars · last push October 20, 2026

ChatGPTNextWeb/NextChat is a TypeScript application that provides an AI chat assistant interface supporting multiple language models and platforms. The repository enables users to access various AI services through a unified web and mobile application.

Nittim scanned 259 files in ChatGPTNextWeb/NextChat and found evidence of security concerns. The scan identified 1 committed credential on a production path and 31 vulnerable runtime dependencies. Fifteen distinct packages contain known vulnerabilities including GHSA-fv7c-fp4j-7gwp in @babel/plugin-transform-modules-systemjs, GHSA-w48q-cv73-mx4w in @modelcontextprotocol/sdk, GHSA-2w69-qvjg-hvjx in @remix-run/router, GHSA-35jp-ww65-95wh and GHSA-3g43-6gmg-66jw in axios, GHSA-3jxr-9vmj-r5cp and GHSA-6j4f-fj2g-mc7p in brace-expansion, GHSA-grv7-fg5c-xmjg in braces, GHSA-73wf-gq98-2v4g and GHSA-c83g-rgw3-j3cx in browserslist, GHSA-3xgq-45jj-v275 in cross-spawn, GHSA-25h7-pfq9-p65f and GHSA-rf6f-7fwh-wjgh in flatted, GHSA-fjxv-7rqg-78g4 and GHSA-hmw2-7cc7-3qxx

Written from nittim's own scan on November 2, 2026; rescanned when the repository changes.

No verdict. The rule-based check reports hard evidence, or reports that it found none. Neither is a judgment on whether this code is safe to ship.

What was read — rule-based scan

Rule-based checks run on nittim's servers — a secret scanner and a dependency check, no model in the path. The code reached those two and stopped there.

Read 259 of 259 eligible files. Commit 1d3dc33. 2026-11-02.

What the scanners found

Committed secrets on production paths
1
Vulnerable runtime dependencies
31

@babel/plugin-transform-modules-systemjs (GHSA-fv7c-fp4j-7gwp), @modelcontextprotocol/sdk (GHSA-w48q-cv73-mx4w), @remix-run/router (GHSA-2w69-qvjg-hvjx), axios (GHSA-35jp-ww65-95wh, GHSA-3g43-6gmg-66jw), brace-expansion (GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p), braces (GHSA-grv7-fg5c-xmjg), browserslist (GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx), cross-spawn (GHSA-3xgq-45jj-v275), flatted (GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh), form-data (GHSA-fjxv-7rqg-78g4, GHSA-hmw2-7cc7-3qxx), immutable (GHSA-v56q-mh7h-f735, GHSA-wf6x-7x77-mvgw, GHSA-xvcm-6775-5m9r), js-yaml (GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj), lodash (GHSA-r5fr-rjxr-66jc), lodash-es (GHSA-r5fr-rjxr-66jc), merge (GHSA-7wpw-2hjm-89gp)

Run it yourself

Scan any public repository in seconds — no sign-in, no card. Audit it to have a model read the code. Loop the report into your assistant to get the fixes applied and re-checked.

Scan your own repo

Questions

What did nittim read in ChatGPTNextWeb/NextChat?
nittim read 259 of 259 eligible files in ChatGPTNextWeb/NextChat. The reading ran on November 2, 2026. It was taken at commit 1d3dc33.
Did nittim find committed secrets or vulnerable dependencies in ChatGPTNextWeb/NextChat?
The rule-based scan found 1 committed secret and 31 vulnerable dependencies in ChatGPTNextWeb/NextChat. Affected: @babel/plugin-transform-modules-systemjs (GHSA-fv7c-fp4j-7gwp), @modelcontextprotocol/sdk (GHSA-w48q-cv73-mx4w), @remix-run/router (GHSA-2w69-qvjg-hvjx), axios (GHSA-35jp-ww65-95wh, GHSA-3g43-6gmg-66jw), brace-expansion (GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p), braces (GHSA-grv7-fg5c-xmjg), browserslist (GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx), cross-spawn (GHSA-3xgq-45jj-v275), flatted (GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh), form-data (GHSA-fjxv-7rqg-78g4, GHSA-hmw2-7cc7-3qxx), immutable (GHSA-v56q-mh7h-f735, GHSA-wf6x-7x77-mvgw, GHSA-xvcm-6775-5m9r), js-yaml (GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj), lodash (GHSA-r5fr-rjxr-66jc), lodash-es (GHSA-r5fr-rjxr-66jc), merge (GHSA-7wpw-2hjm-89gp).
Is ChatGPTNextWeb/NextChat production ready?
A free scan is not a verdict. A full audit gives one.

More like this

More TypeScript repositories →

Add the badge to your README
README badge
nittim verdict badge for ChatGPTNextWeb/NextChat[![nittim](https://nittim.com/api/badge/ChatGPTNextWeb/NextChat)](https://nittim.com/library/ChatGPTNextWeb/NextChat)