Loading report…
← nittim
← nittimshared scan
mattermost/mattermost ↗ · c864f8d · Aug 21, 2026, 10:28 PM
We found hard evidence. 19 things need your attention now.We found real evidence of problems. 19 things need your attention now.19 issues need attention now.
Free scan · deterministic evidence onlyFree scan · found by automatic checks onlyFree scan · deterministic evidence only
These are facts from deterministic scanners, not opinion — 19 high/critical dependency vulnerabilities. The full picture — architecture, AI-generated-code risk, privacy, and 11 more dimensions — needs Audit.
These are facts found by automatic checks, not opinions — 19 serious security bugs in the ready-made packages your project uses. The full picture — how your code is built, AI-generated-code risk, privacy, and 11 more areas — needs Audit.
19 critical dependency vulnerabilities found. 11 more dimensions need Audit for the full picture.
138 of 15580 files scanned (<1%) — this snapshot was truncated: this audit's size limit was reached, so some source was left unread.
Read 138 of 274 selected files — this repository's archive was too large to finish in one scan.
What this meansWhat this means for youWhat this means
Two scanners read 138 of 15580 files, starting with the highest-priority ones: one for committed credentials, one for known vulnerabilities in your dependencies. They found 0 committed credentials on production paths and 19 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep Verification is the tier that issues a verdict. This scan does not.
Read it:
Packages you ship with known vulnerabilities
cvenpm minimatch3 in 1 version
5.1.6 — GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions — HIGH
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern — HIGH
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments — HIGH
cvenpm brace-expansion2 in 1 version
2.0.1 — GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — HIGH
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — HIGH
cvenpm form-data2 in 1 version
4.0.0 — GHSA-fjxv-7rqg-78g4, GHSA-hmw2-7cc7-3qxx
form-data uses unsafe random function in form-data for choosing boundary — CRITICAL
form-data: CRLF injection in form-data via unescaped multipart field names and filenames — HIGH
cvenpm handlebars2 in 1 version
4.7.8 — GHSA-2w6w-674q-4c4q, GHSA-3mfm-83xf-c92r
Handlebars.js has JavaScript Injection via AST Type Confusion — CRITICAL
Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block — HIGH
cvenpm js-yaml2 in 1 version
3.14.1 — GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj
js-yaml: YAML merge-key chains can force quadratic CPU consumption — HIGH
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — HIGH
cvenpm nanoid2 in 1 version
3.3.7 — GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8
nanoid: non-secure generators can loop indefinitely with negative size — HIGH
nanoid: custom generators can loop indefinitely when size is zero — HIGH
cvenpm ws2 in 1 version
8.17.0 — GHSA-3h5v-q93c-6h6q, GHSA-96hv-2xvq-fx4p
ws affected by a DoS when handling a request with many HTTP headers — HIGH
ws: Memory exhaustion DoS from tiny fragments and data chunks — HIGH
cvenpm picomatch@2.3.1GHSA-c2c7-rcm5-vvqj
Picomatch has a ReDoS vulnerability via extglob quantifiers — HIGH
cvenpm postcss@8.4.38GHSA-6g55-p6wh-862q
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments — HIGH
cvenpm redoc@2.1.4GHSA-9rhg-254w-fh9x
Redoc Prototype Pollution via `Module.mergeObjects` Component — HIGH
cvenpm yaml@2.1.1GHSA-f9xv-q969-pqx4
Uncaught Exception in yaml — HIGH
Worth knowing, not blocking
dev depnpm js-yaml4 in 2 versions
3.14.1 — GHSA-h67p-54hq-rp68
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases — MODERATE
4.1.1 — GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68
js-yaml: YAML merge-key chains can force quadratic CPU consumption — devDependency
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — devDependency
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases — devDependency
moderate cvenpm dompurify3 in 1 version
3.1.4 — GHSA-39q2-94rc-95cp, GHSA-55q2-fjhq-7xh7, GHSA-76mc-f452-cxcm
DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation — MODERATE
DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS — MODERATE
DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR` — MODERATE
dev depnpm ip-address3 in 1 version
10.2.0 — GHSA-22jq-vg5j-6vgg, GHSA-4xrf-jv44-h6hh, GHSA-mwp4-54f8-5fhr
ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks — devDependency
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks — devDependency
ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass — devDependency
dev depnpm ws3 in 2 versions
8.17.0 — GHSA-58qx-3vcg-4xpx
ws: Uninitialized memory disclosure — MODERATE
8.20.0 — GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p
ws: Uninitialized memory disclosure — devDependency
ws: Memory exhaustion DoS from tiny fragments and data chunks — devDependency
advisory cveGo golang.org/x/mod2 in 1 version
0.36.0 — GO-2026-6179, GO-2026-6180
Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog — UNKNOWN
Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb — UNKNOWN
moderate cvenpm postcss2 in 1 version
8.4.38 — GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset — MODERATE
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output — MODERATE
dev depnpm @babel/core@7.29.0GHSA-4x5r-pxfx-6jf8
@babel/core: Arbitrary File Read via sourceMappingURL Comment — devDependency
moderate cvenpm @babel/runtime@7.24.6GHSA-968p-4wvh-cqc8
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups — MODERATE
low cvenpm @tootallnate/once@2.0.0GHSA-vpq2-c234-7xj6
@tootallnate/once vulnerable to Incorrect Control Flow Scoping — LOW
moderate cvenpm ajv@8.11.0GHSA-2g4f-4pwh-qvx6
ajv has ReDoS when using `$data` option — MODERATE
moderate cvenpm brace-expansion@2.0.1GHSA-f886-m6hf-6m8v
brace-expansion: Zero-step sequence causes process hang and memory exhaustion — MODERATE
dev depnpm extract-zip@2.0.1GHSA-jmr9-qjv8-65gv
extract-zip unvalidated symlink path traversal — devDependency
moderate cvenpm handlebars@4.7.8GHSA-2qvq-rjwj-gvw9
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection — MODERATE
moderate cvenpm micromatch@4.0.7GHSA-952p-6rrq-rcjv
Regular Expression Denial of Service (ReDoS) in micromatch — MODERATE
moderate cvenpm nanoid@3.3.7GHSA-mwcw-c2x4-8c55
Predictable results in nanoid generation when given non-integer values — MODERATE
moderate cvenpm picomatch@2.3.1GHSA-3v7f-55p6-f55p
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching — MODERATE
moderate cvenpm prismjs@1.29.0GHSA-x7hr-w5r2-h6wg
PrismJS DOM Clobbering vulnerability — MODERATE
moderate cvenpm yaml@2.1.1GHSA-48c2-rrv3-qjmp
yaml is vulnerable to Stack Overflow via deeply nested YAML collections — MODERATE
AI audit for mattermost/mattermost · all 14 dimensions · usually within 15 minutes*AI check for mattermost/mattermost · all 14 areas · usually within 15 minutes*AI audit · mattermost/mattermost · 14 dimensions · usually within 15 minutes*
14 things we haven't looked at yet14 things we haven't checked yet14 things unaudited
Security logic, privacy, reliability, AI-generated-code risk and 10 more — unaudited, not clean.Security logic, privacy, reliability, AI-generated-code risk and 10 more — not checked yet, which is different from safe.Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.
The free scan reasons across none of these. Absence of findings is reported as unaudited, not safe. Opus 4.8 reads the code semantically and scores every one — with evidence, business impact, and a fix per finding.
The free scan doesn't look at any of these. If nothing is flagged here, that means it wasn't checked — not that it's safe. Opus 4.8 (the AI model behind the audit) reads and understands your code and scores every one of these — with evidence, the real-world impact, and a fix for each finding.
The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.
SecurityPriority: Core
Privacy & CompliancePriority: Core
Reliability & ResiliencePriority: Core
Code Quality & ArchitecturePriority: Important
AI / Vibe Coding RiskPriority: Important
Performance & ScalabilityPriority: Important
Infrastructure & DevOpsPriority: Important
Data LayerPriority: Important
Business & Product RiskPriority: Supporting
Developer ExperiencePriority: Supporting
Accessibility & UXPriority: Supporting
ObservabilityPriority: Supporting
Maintainability ForecastPriority: Specialized
IP & Novelty ExposurePriority: Specialized
Modules run (2)
Hardcoded Secret ScanDependency Vulnerability Scan
Scanned 138 of 15580 files (highest-priority subset) · mattermost/mattermost
Dependency manifests: 4 package roots found, 4 scanned; 4 Go manifests read — package list truncated at the vulnerability-lookup limit.
README badgeBadge for your project's readme fileREADME badge
[](https://nittim.com)