What did nittim read in TryGhost/Ghost?

nittim read 500 of 8541 eligible files in TryGhost/Ghost. The reading ran on August 21, 2026. It was taken at commit 81292b0.

← Browse the report library

a public repository, read by nittim

Is TryGhost/Ghost production ready?

What nittim read in this repository, and what it found. Public repository, public reading — sourced from its own code and dependency manifests, nothing else.

The publishing platform behind a large share of paid newsletters.

JavaScript · 54.9k stars

No verdict. The rule-based check reports hard evidence, or reports that it found none. Neither is a judgment on whether this code is safe to ship.

What was read — rule-based scan

Rule-based checks run on nittim's servers — a secret scanner and a dependency check, no model in the path. The code reached those two and stopped there.

Read 500 of 8541 eligible files. Commit 81292b0. 2026-08-21.

What the scanners found

Committed secrets on production paths: 0
Vulnerable runtime dependencies: 8

html-minifier (GHSA-pfq8-rq6v-vf5m), image-size (GHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr), js-yaml (GHSA-5p4m-2wfm-xmqj), jsonwebtoken (GHSA-8cf7-32gw-wr33), nodemailer (GHSA-p6gq-j5cr-w38f), react-router (GHSA-qwww-vcr4-c8h2), validator (GHSA-vghf-hv5q-vc2g)

Run it yourself

Scan any public repository in seconds — no sign-in, no card. Audit it to have a model read the code. Loop the report into your assistant to get the fixes applied and re-checked.

Scan your own repo

Questions

What did nittim read in TryGhost/Ghost?: nittim read 500 of 8541 eligible files in TryGhost/Ghost. The reading ran on August 21, 2026. It was taken at commit 81292b0.
Did nittim find committed secrets or vulnerable dependencies in TryGhost/Ghost?: The rule-based scan found 0 committed secrets and 8 vulnerable dependencies in TryGhost/Ghost. Affected: html-minifier (GHSA-pfq8-rq6v-vf5m), image-size (GHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr), js-yaml (GHSA-5p4m-2wfm-xmqj), jsonwebtoken (GHSA-8cf7-32gw-wr33), nodemailer (GHSA-p6gq-j5cr-w38f), react-router (GHSA-qwww-vcr4-c8h2), validator (GHSA-vghf-hv5q-vc2g).
Is TryGhost/Ghost production ready?: A free scan is not a verdict. A full audit gives one.

More like this

More JavaScript repositories →

Add the badge to your README

README badge

[![nittim](https://nittim.com/api/badge/TryGhost/Ghost)](https://nittim.com/library/TryGhost/Ghost)