Loading report…
← nittim
← nittimshared scan
OWASP/railsgoat ↗ · 0222f7d · Aug 21, 2026, 11:08 PM
We found hard evidence. 1 thing needs your attention now.We found real evidence of problems. 1 thing needs your attention now.1 issue needs attention now.
Free scan · deterministic evidence onlyFree scan · found by automatic checks onlyFree scan · deterministic evidence only
These are facts from deterministic scanners, not opinion — 1 committed production secret. The full picture — architecture, AI-generated-code risk, privacy, and 11 more dimensions — needs Audit.
These are facts found by automatic checks, not opinions — 1 password or key found in code that ships to production. The full picture — how your code is built, AI-generated-code risk, privacy, and 11 more areas — needs Audit.
1 committed secret found. 11 more dimensions need Audit for the full picture.
168 of 275 files scanned (61%). Nothing was cut short by a limit — the rest is mostly images, generated output, and other non-source content this audit doesn't read.
What this meansWhat this means for youWhat this means
Two scanners read 168 of 275 files: one for committed credentials, one for known vulnerabilities in your dependencies. They found 1 committed credential on production paths and 0 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep AI is the tier that issues a verdict. This scan does not.
Read it:
Secrets committed on production paths
secretGeneric hardcoded secretdb/seeds.rb:46
passwo…445",
Worth knowing, not blocking
advisoryGeneric hardcoded secretapp/assets/javascripts/bootstrap-image-gallery-main.js:61
// api_ke…be3' — non-production path
AI audit for OWASP/railsgoat · all 14 dimensions · usually within 15 minutes*AI check for OWASP/railsgoat · all 14 areas · usually within 15 minutes*AI audit · OWASP/railsgoat · 14 dimensions · usually within 15 minutes*
14 things we haven't looked at yet14 things we haven't checked yet14 things unaudited
Security logic, privacy, reliability, AI-generated-code risk and 10 more — unaudited, not clean.Security logic, privacy, reliability, AI-generated-code risk and 10 more — not checked yet, which is different from safe.Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.
The free scan reasons across none of these. Absence of findings is reported as unaudited, not safe. Opus 4.8 reads the code semantically and scores every one — with evidence, business impact, and a fix per finding.
The free scan doesn't look at any of these. If nothing is flagged here, that means it wasn't checked — not that it's safe. Opus 4.8 (the AI model behind the audit) reads and understands your code and scores every one of these — with evidence, the real-world impact, and a fix for each finding.
The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.
SecurityPriority: Core
Privacy & CompliancePriority: Core
Reliability & ResiliencePriority: Core
Code Quality & ArchitecturePriority: Important
AI / Vibe Coding RiskPriority: Important
Performance & ScalabilityPriority: Important
Infrastructure & DevOpsPriority: Important
Data LayerPriority: Important
Business & Product RiskPriority: Supporting
Developer ExperiencePriority: Supporting
Accessibility & UXPriority: Supporting
ObservabilityPriority: Supporting
Maintainability ForecastPriority: Specialized
IP & Novelty ExposurePriority: Specialized
Modules run (2)
Hardcoded Secret ScanDependency Vulnerability Scan
Scanned 168 of 275 files · OWASP/railsgoat
Dependency manifests: none found — the dependency scan had nothing to read. Ruby dependencies detected — dependency-CVE scanning does not cover it yet; CVEs there are UNVERIFIED, not absent.
README badgeBadge for your project's readme fileREADME badge
[](https://nittim.com)