a public repository, read by nittim
Is OWASP/NodeGoat production ready?
What nittim read in this repository, and what it found. Public repository, public reading — sourced from its own code and dependency manifests, nothing else.
OWASP's Node app for learning the Top 10 by exploiting it.
HTML · 2.1k stars
No verdict. The rule-based check reports hard evidence, or reports that it found none. Neither is a judgment on whether this code is safe to ship.
What was read — rule-based scan
Rule-based checks run on nittim's servers — a secret scanner and a dependency check, no model in the path. The code reached those two and stopped there.
Read 83 of 111 eligible files. Commit c5cb68a. 2026-08-21.
What the scanners found
- Committed secrets on production paths
- 0
- Vulnerable runtime dependencies
- 9
body-parser (GHSA-qwcr-r2fm-qrc7), brace-expansion (GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg), braces (GHSA-grv7-fg5c-xmjg), bson (GHSA-v8w9-2789-6hhr), decode-uri-component (GHSA-w573-4hg7-7wgq), fsevents (GHSA-8r6j-v8pm-fqw3), i (GHSA-x55w-vjjp-222r), ini (GHSA-qqgx-2p2h-9c37)
Run it yourself
Scan any public repository in seconds — no sign-in, no card. Audit it to have a model read the code. Loop the report into your assistant to get the fixes applied and re-checked.
Scan your own repoQuestions
- What did nittim read in OWASP/NodeGoat?
- nittim read 83 of 111 eligible files in OWASP/NodeGoat. The reading ran on August 21, 2026. It was taken at commit c5cb68a.
- Did nittim find committed secrets or vulnerable dependencies in OWASP/NodeGoat?
- The rule-based scan found 0 committed secrets and 9 vulnerable dependencies in OWASP/NodeGoat. Affected: body-parser (GHSA-qwcr-r2fm-qrc7), brace-expansion (GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg), braces (GHSA-grv7-fg5c-xmjg), bson (GHSA-v8w9-2789-6hhr), decode-uri-component (GHSA-w573-4hg7-7wgq), fsevents (GHSA-8r6j-v8pm-fqw3), i (GHSA-x55w-vjjp-222r), ini (GHSA-qqgx-2p2h-9c37).
- Is OWASP/NodeGoat production ready?
- A free scan is not a verdict. A full audit gives one.
More like this
Add the badge to your README
[](https://nittim.com/library/OWASP/NodeGoat)