Loading report…
← nittim
← nittimshared scan
colinhacks/zod ↗ · e516c3b · Aug 21, 2026, 10:44 PM
Hard evidence: 7 issues need attention now.
Free scan · deterministic evidence only
7 critical dependency vulnerabilities found. 11 more dimensions need Audit for the full picture.
500 of 666 files scanned (75%) — this snapshot was truncated: this audit's size limit was reached, so some source was left unread.
What this means
Two scanners read 500 of 666 files, starting with the highest-priority ones: one for committed credentials, one for known vulnerabilities in your dependencies. They found 0 committed credentials on production paths and 7 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep Verification is the tier that issues a verdict. This scan does not.
Read it:
Packages you ship with known vulnerabilities
cvenpm brace-expansion4 in 2 versions
1.1.11 — GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — HIGH
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — HIGH
2.0.1 — GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — HIGH
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — HIGH
cvenpm next3 in 1 version
15.5.15 — GHSA-267c-6grr-h53f, GHSA-26hh-7cqf-hhc6, GHSA-36qx-fr4f-26g5
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes — HIGH
Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up — HIGH
Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n — HIGH
Worth knowing, not blocking
moderate cvenpm brace-expansion2 in 2 versions
1.1.11 — GHSA-f886-m6hf-6m8v
brace-expansion: Zero-step sequence causes process hang and memory exhaustion — MODERATE
2.0.1 — GHSA-f886-m6hf-6m8v
brace-expansion: Zero-step sequence causes process hang and memory exhaustion — MODERATE
dev depnpm postcss2 in 1 version
8.5.12 — GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset — devDependency
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure — devDependency
dev depnpm vite2 in 1 version
7.3.2 — GHSA-fx2h-pf6j-xcff, GHSA-v6wh-96g9-6wx3
vite: `server.fs.deny` bypass on Windows alternate paths — devDependency
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows — devDependency
low cvenpm @tootallnate/once@2.0.0GHSA-vpq2-c234-7xj6
@tootallnate/once vulnerable to Incorrect Control Flow Scoping — LOW
moderate cvenpm ajv@8.17.1GHSA-2g4f-4pwh-qvx6
ajv has ReDoS when using `$data` option — MODERATE
moderate cvenpm altcha-lib@1.2.0GHSA-6gvq-jcmp-8959
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay — MODERATE
dev depnpm valibot@1.3.1GHSA-5qjj-4xww-7phc
Valibot: record() issue paths can make flatten() throw for inherited Object property names — devDependency
AI audit · colinhacks/zod · 14 dimensions · usually within 15 minutes*
14 things unaudited
Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.
The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.
SecurityPriority: Core
Privacy & CompliancePriority: Core
Reliability & ResiliencePriority: Core
Code Quality & ArchitecturePriority: Important
AI / Vibe Coding RiskPriority: Important
Performance & ScalabilityPriority: Important
Infrastructure & DevOpsPriority: Important
Data LayerPriority: Important
Business & Product RiskPriority: Supporting
Developer ExperiencePriority: Supporting
Accessibility & UXPriority: Supporting
ObservabilityPriority: Supporting
Maintainability ForecastPriority: Specialized
IP & Novelty ExposurePriority: Specialized
Modules run (2)
Hardcoded Secret ScanDependency Vulnerability Scan
Scanned 500 of 666 files (highest-priority subset) · colinhacks/zod
Dependency manifests: 8 package roots found, 5 scanned — package list truncated at the vulnerability-lookup limit.
README badge
[](https://nittim.com/library/colinhacks/zod)