juice-shop/juice-shop · audit

juice-shop/juice-shop ↗ · 1618a61 · Aug 21, 2026, 11:04 PM

We found hard evidence. 16 things need your attention now.We found real evidence of problems. 16 things need your attention now.16 issues need attention now.

Free scan · deterministic evidence onlyFree scan · found by automatic checks onlyFree scan · deterministic evidence only

These are facts from deterministic scanners, not opinion — 1 committed production secret and 15 high/critical dependency vulnerabilities. The full picture — architecture, AI-generated-code risk, privacy, and 11 more dimensions — needs Audit.

These are facts found by automatic checks, not opinions — 1 password or key found in code that ships to production and 15 serious security bugs in the ready-made packages your project uses. The full picture — how your code is built, AI-generated-code risk, privacy, and 11 more areas — needs Audit.

1 committed secret and 15 critical dependency vulnerabilities found. 11 more dimensions need Audit for the full picture.

387 of 1300 files scanned (29%) — this snapshot was truncated: this audit's size limit was reached, so some source was left unread.

What this meansWhat this means for youWhat this means

Two scanners read 387 of 1300 files, starting with the highest-priority ones: one for committed credentials, one for known vulnerabilities in your dependencies. They found 1 committed credential on production paths and 15 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep AI is the tier that issues a verdict. This scan does not.

Read it:

Secrets committed on production paths

1 found · 1 file

secretGeneric hardcoded secretfrontend/src/app/login/login.component.ts:63

public testingPasswo…ing'

Packages you ship with known vulnerabilities

15 found · 10 packages

cvenpm multer3 in 1 version

1.4.5-lts.1 — GHSA-44fp-w29j-9vj5, GHSA-4pg4-qvpc-4q3h, GHSA-5528-5vmv-3xc2

Multer vulnerable to Denial of Service via memory leaks from unclosed streams — HIGH

Multer vulnerable to Denial of Service from maliciously crafted requests — HIGH

Multer Vulnerable to Denial of Service via Uncontrolled Recursion — HIGH

cvenpm js-yaml2 in 1 version

3.14.0 — GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj

js-yaml: YAML merge-key chains can force quadratic CPU consumption — HIGH

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — HIGH

cvenpm jsonwebtoken2 in 1 version

0.4.0 — GHSA-8cf7-32gw-wr33, GHSA-c7hr-j4mj-j2w6

jsonwebtoken unrestricted key type could lead to legacy keys usage — HIGH

Verification Bypass in jsonwebtoken — CRITICAL

cvenpm sequelize2 in 1 version

6.37.3 — GHSA-6457-6jrx-69cr, GHSA-v8fg-2rw7-q452

Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type — HIGH

Sequelize: SQL Injection (Oracle DB) — CRITICAL

cvenpm @angular/common@22.0.1GHSA-jhpw-976m-542j

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning — HIGH

cvenpm express-jwt@0.1.3GHSA-6g6m-m6h5-w9gf

Authorization bypass in express-jwt — HIGH

cvenpm glob@10.4.5GHSA-5j98-mcp5-4vw2

glob CLI: Command injection via -c/--cmd executes matches with shell:true — HIGH

cvenpm lodash-es@4.17.21GHSA-r5fr-rjxr-66jc

lodash vulnerable to Code Injection via `_.template` imports key names — HIGH

cvenpm marsdb@0.6.11GHSA-5mrr-rgp6-x4gr

Command Injection in marsdb — CRITICAL

cvenpm sanitize-html@1.4.2GHSA-cgfm-xwp7-2cvr

Sanitize-html Vulnerable To REDoS Attacks — HIGH

Worth knowing, not blocking

77 found · 18 files · 9 packages · 66 in tests

Test/example/doc credentials and devDependency or moderate/low CVEs. Surfaced as context — these never force the worst verdict.Passwords found in test, example or documentation files, and lower-severity security bugs in packages only used while building the project. Shown for context — these never cause the worst possible result.Context only — test/example secrets, dev-only or moderate/low CVEs. Never verdict-forcing.

test fixtureGeneric hardcoded secret63 in 17 files

frontend/src/app/oauth/oauth.component.spec.ts:91, :98

:91 — expect(userService.save).toHaveBeenCalledWith({ email: 'test@test.com', passwo…A==', passwordRepeat: 'bW9jLnRzZXRAdHNldA==' }) — non-production path

:98 — expect(userService.login).toHaveBeenCalledWith({ email: 'test@test.com', passwo…A==', oauth: true }) — non-production path

frontend/src/app/Services/two-factor-auth-service.spec.ts:68

:68 — expect(req.request.body).toEqual({ password: 's3cr3t!', initialToken:…ken', setupToken: 'setupToken' }) — non-production path

frontend/src/app/two-factor-auth/two-factor-auth.component.spec.ts:243

:243 — twoFactorAuthService.status.mockReturnValue(of({ setup: false, email: 'e', secret…ret', setupToken: 't' })) — non-production path

test/api/2fa.test.ts:42, :66, :85, :104, :123, :141, :142, :156, :182, :214, :240, :257, :266, :291, :292, :317, :352, :379, :412

:42 — const totpToken = generateSync({ secret…3KH' }) — non-production path

:66 — const totpToken = generateSync({ secret…X4H' }) — non-production path

:85 — const totpToken = generateSync({ secret…3KH' }) — non-production path

:104 — const totpToken = generateSync({ secret…3KH' }) — non-production path

:123 — const totpToken = generateSync({ secret…3KH' }) — non-production path

:141 — passwo…EN!', — non-production path

:142 — totpSecret…3KH' — non-production path

:156 — passwo…6lB' — non-production path

:182 — const secret…ML7' — non-production path

:214 — const secret…ML7' — non-production path

:240 — const secret…ML7' — non-production path

:257 — initialToken: generateSync({ secret…QOJ' }) — non-production path

:266 — const secret…ML7' — non-production path

:291 — const passwo…EN!' — non-production path

:292 — const totpSecret…3KH' — non-production path

:317 — const secret…ML7' — non-production path

:352 — const totpSecret…ML7' — non-production path

:379 — const totpSecret…ML7' — non-production path

:412 — totpSecret…ML7' — non-production path

test/api/basket.test.ts:114, :170

:114 — passwo…mI=' — non-production path

:170 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

test/api/chat.test.ts:261

:261 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

test/api/data-export.test.ts:53, :73, :90, :110

:53 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

:73 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

:90 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

:110 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

test/api/delivery.test.ts:54, :115

:54 — passwo…bJb' — non-production path

:115 — passwo…bJb' — non-production path

test/api/deluxe.test.ts:25, :40, :85, :128, :165

:25 — passwo…or!' — non-production path

:40 — passwo…bJb' — non-production path

:85 — passwo…or!' — non-production path

:128 — passwo…...' — non-production path

:165 — passwo…bJb' — non-production path

test/api/erasure-request.test.ts:36, :55, :68, :82, :94, :106

:36 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

:55 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

:68 — .send({ email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

:82 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

:94 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

:106 — const { token } = await login(app, { email: 'bjoern.kimminich@gmail.com', passwo…mI=' }) — non-production path

test/api/feedback.test.ts:117, :143

:117 — passwo…mI=' — non-production path

:143 — passwo…mI=' — non-production path

test/api/login.test.ts:90, :118, :132, :147, :245, :267

:90 — passwo…F$P' — non-production path

:118 — passwo…...' — non-production path

:132 — passwo…EN!' — non-production path

:147 — passwo…mI=' — non-production path

:245 — passwo…mI=' — non-production path

:267 — passwo…mI=' — non-production path

test/api/password.test.ts:95

:95 — passwo…or!' — non-production path

test/api/product-review.test.ts:101, :115

:101 — passwo…mI=' — non-production path

:115 — passwo…mI=' — non-production path

test/api/user-profile.test.ts:58

:58 — const { token } = await login(app, { email: 'ciso@juice-sh.op', passwo…bJb' }) — non-production path

test/api/user.test.ts:189, :240, :289, :304, :318

:189 — passwo…ter' — non-production path

:240 — passwo…mI=' — non-production path

:289 — passwo…mI=' — non-production path

:304 — passwo…mI=' — non-production path

:318 — passwo…mI=' — non-production path

test/cypress/e2e/changePassword.spec.ts:6, :25, :31

:6 — passwo…nce' — non-production path

:25 — passwo…or!' — non-production path

:31 — cy.login({ email: 'bender', passwo…sic' }) — non-production path

test fixtureJSON Web Token3 in 2 files

frontend/src/app/last-login-ip/last-login-ip.component.spec.ts:72, :78

:72 — localStorage.setItem('token', 'eyJhbG…t3bg') — non-production path

:78 — localStorage.setItem('token', 'eyJhbG…enLw') — non-production path

test/api/user.test.ts:280

:280 — .set({ Authorization: 'eyJhbG…pC8g' }) — non-production path

moderate cvenpm lodash-es2 in 1 version

4.17.21 — GHSA-f23m-r3pf-42rh, GHSA-xxjr-mmjv-4gpg

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` — MODERATE

Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions — MODERATE

moderate cvenpm sanitize-html2 in 1 version

1.4.2 — GHSA-3j7m-hmh3-9jmp, GHSA-mjxr-4v3x-q3m4

Cross-Site Scripting in sanitize-html — MODERATE

Improper Input Validation in sanitize-html — MODERATE

low cvenpm body-parser@1.20.4GHSA-v422-hmwv-36x6

body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement — LOW

moderate cvenpm file-type@16.5.4GHSA-5v7r-6r5c-r473

file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header — MODERATE

moderate cvenpm js-yaml@3.14.0GHSA-h67p-54hq-rp68

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases — MODERATE

moderate cvenpm jsonwebtoken@0.4.0GHSA-hjrf-2m68-5959

jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC — MODERATE

moderate cvenpm morgan@1.10.0GHSA-4vj7-5mj6-jm8m

morgan vulnerable to Log Forging via unneutralized control characters in :remote-user — MODERATE

moderate cvenpm notevil@1.3.3GHSA-8g4m-cjm2-96wq

Sandbox escape in notevil and argencoders-notevil — MODERATE

moderate cvenpm socket.io@3.1.2GHSA-25hc-qcg6-38wj

socket.io has an unhandled 'error' event — MODERATE

AI audit for juice-shop/juice-shop · all 14 dimensions · usually within 15 minutes*AI check for juice-shop/juice-shop · all 14 areas · usually within 15 minutes*AI audit · juice-shop/juice-shop · 14 dimensions · usually within 15 minutes*

Audit — your first Audit is free. After that, about $5.Needs a free GitHub or Google sign-inNeeds a free sign-in with GitHub or GoogleNeeds a free GitHub or Google sign-inThe free scan stays unlimitedYou can run the free scan as many times as you likeThe free scan stays unlimited

14 things we haven't looked at yet14 things we haven't checked yet14 things unaudited

Security logic, privacy, reliability, AI-generated-code risk and 10 more — unaudited, not clean.Security logic, privacy, reliability, AI-generated-code risk and 10 more — not checked yet, which is different from safe.Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.

The free scan reasons across none of these. Absence of findings is reported as unaudited, not safe. Opus 4.8 reads the code semantically and scores every one — with evidence, business impact, and a fix per finding.

The free scan doesn't look at any of these. If nothing is flagged here, that means it wasn't checked — not that it's safe. Opus 4.8 (the AI model behind the audit) reads and understands your code and scores every one of these — with evidence, the real-world impact, and a fix for each finding.

The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.

SecurityPriority: Core

Privacy & CompliancePriority: Core

Reliability & ResiliencePriority: Core

Code Quality & ArchitecturePriority: Important

AI / Vibe Coding RiskPriority: Important

Performance & ScalabilityPriority: Important

Infrastructure & DevOpsPriority: Important

Data LayerPriority: Important

Business & Product RiskPriority: Supporting

Developer ExperiencePriority: Supporting

Accessibility & UXPriority: Supporting

ObservabilityPriority: Supporting

Maintainability ForecastPriority: Specialized

IP & Novelty ExposurePriority: Specialized

Modules run (2)

Hardcoded Secret ScanDependency Vulnerability Scan

Hover a module for why it was selected. See every check nittim can run.

Scanned 387 of 1300 files (highest-priority subset) · juice-shop/juice-shop
Dependency manifests: 2 package roots found, 2 scanned.

README badgeBadge for your project's readme fileREADME badge

nittim verdict badge for juice-shop/juice-shop

[![nittim](https://nittim.com/api/badge/juice-shop/juice-shop)](https://nittim.com)