Loading report…
← nittim
← nittimshared scan
appsecco/dvna ↗ · 9ba473a · Aug 21, 2026, 11:06 PM
We found hard evidence. 14 things need your attention now.We found real evidence of problems. 14 things need your attention now.14 issues need attention now.
Free scan · deterministic evidence onlyFree scan · found by automatic checks onlyFree scan · deterministic evidence only
These are facts from deterministic scanners, not opinion — 14 high/critical dependency vulnerabilities. The full picture — architecture, AI-generated-code risk, privacy, and 11 more dimensions — needs Audit.
These are facts found by automatic checks, not opinions — 14 serious security bugs in the ready-made packages your project uses. The full picture — how your code is built, AI-generated-code risk, privacy, and 11 more areas — needs Audit.
14 critical dependency vulnerabilities found. 11 more dimensions need Audit for the full picture.
41 of 151 files scanned (27%). Nothing was cut short by a limit — the rest is mostly images, generated output, and other non-source content this audit doesn't read.
What this meansWhat this means for youWhat this means
Two scanners read 41 of 151 files: one for committed credentials, one for known vulnerabilities in your dependencies. They found 0 committed credentials on production paths and 14 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep AI is the tier that issues a verdict. This scan does not.
Read it:
Packages you ship with known vulnerabilities
cvenpm libxmljs3 in 1 version
0.19.1 — GHSA-6433-x5p4-8jc7, GHSA-773h-w45w-f2f9, GHSA-jv72-59wq-8rxm
libxmljs vulnerable to type confusion when parsing specially crafted XML — CRITICAL
Denial of service vulnerability exists in libxmljs — HIGH
libxmljs has segmentation fault, potentially leading to a denial-of-service (DoS) — HIGH
cvenpm mathjs3 in 1 version
3.10.1 — GHSA-pv8x-p9hq-j328, GHSA-vx5c-87qx-cv6c, GHSA-x2fc-mxcx-w4mf
Arbitrary Code Execution in mathjs — CRITICAL
Arbitrary Code Execution in mathjs — CRITICAL
Prototype Pollution in mathjs — HIGH
cvenpm express-fileupload2 in 1 version
0.4.0 — GHSA-9wcg-jrwf-8gg7, GHSA-w4m6-x6c2-j5c9
Prototype Pollution in express-fileupload — CRITICAL
Express-FileUpload Arbitrary File Overwrite — HIGH
cvenpm mysql22 in 1 version
1.4.2 — GHSA-4rch-2fh8-94vw, GHSA-fpw7-j2hg-69v5
MySQL2 for Node Arbitrary Code Injection — CRITICAL
mysql2 Remote Code Execution (RCE) via the readCodeFor function — CRITICAL
cvenpm ejs@2.5.7GHSA-phwq-j96m-2c2q
ejs template injection vulnerability — CRITICAL
cvenpm morgan@1.9.0GHSA-gwg9-rgvj-4h5j
Code Injection in morgan — CRITICAL
cvenpm node-serialize@0.0.4GHSA-q4v7-4rhw-9hqm
Code Execution through IIFE in node-serialize — CRITICAL
cvenpm sequelize@4.13.10GHSA-f598-mfpv-gmfx
Sequelize - Default support for “raw attributes” when using parentheses — CRITICAL
Worth knowing, not blocking
low cvenpm express2 in 1 version
4.16.2 — GHSA-qw6h-vgh9-j6wx, GHSA-rv95-896h-c2vc
express vulnerable to XSS via response.redirect() — LOW
Express.js Open Redirect in malformed URLs — MODERATE
moderate cvenpm sequelize2 in 1 version
4.13.10 — GHSA-8c25-f3mj-v6h8, GHSA-fw4p-36j9-rrj3
Sequelize information disclosure vulnerability — MODERATE
Denial of Service in sequelize — MODERATE
moderate cvenpm bcrypt@1.0.3GHSA-5wg4-74h6-q47v
Integer Overflow or Wraparound and Use of a Broken or Risky Cryptographic Algorithm in bcrypt — MODERATE
moderate cvenpm ejs@2.5.7GHSA-ghr5-ch3p-vcr6
ejs lacks certain pollution protection — MODERATE
low cvenpm express-fileupload@0.4.0GHSA-q3w9-g74q-vp5f
Denial of Service in express-fileupload — LOW
moderate cvenpm morgan@1.9.0GHSA-4vj7-5mj6-jm8m
morgan vulnerable to Log Forging via unneutralized control characters in :remote-user — MODERATE
moderate cvenpm mysql2@1.4.2GHSA-49j4-86m8-q2jw
mysql2 vulnerable to Prototype Poisoning — MODERATE
moderate cvenpm passport@0.4.0GHSA-v923-w3x8-wh69
Passport vulnerable to session regeneration when a users logs in or out — MODERATE
AI audit for appsecco/dvna · all 14 dimensions · usually within 15 minutes*AI check for appsecco/dvna · all 14 areas · usually within 15 minutes*AI audit · appsecco/dvna · 14 dimensions · usually within 15 minutes*
14 things we haven't looked at yet14 things we haven't checked yet14 things unaudited
Security logic, privacy, reliability, AI-generated-code risk and 10 more — unaudited, not clean.Security logic, privacy, reliability, AI-generated-code risk and 10 more — not checked yet, which is different from safe.Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.
The free scan reasons across none of these. Absence of findings is reported as unaudited, not safe. Opus 4.8 reads the code semantically and scores every one — with evidence, business impact, and a fix per finding.
The free scan doesn't look at any of these. If nothing is flagged here, that means it wasn't checked — not that it's safe. Opus 4.8 (the AI model behind the audit) reads and understands your code and scores every one of these — with evidence, the real-world impact, and a fix for each finding.
The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.
SecurityPriority: Core
Privacy & CompliancePriority: Core
Reliability & ResiliencePriority: Core
Code Quality & ArchitecturePriority: Important
AI / Vibe Coding RiskPriority: Important
Performance & ScalabilityPriority: Important
Infrastructure & DevOpsPriority: Important
Data LayerPriority: Important
Business & Product RiskPriority: Supporting
Developer ExperiencePriority: Supporting
Accessibility & UXPriority: Supporting
ObservabilityPriority: Supporting
Maintainability ForecastPriority: Specialized
IP & Novelty ExposurePriority: Specialized
Modules run (2)
Hardcoded Secret ScanDependency Vulnerability Scan
Scanned 41 of 151 files · appsecco/dvna
Dependency manifests: 1 package root found, 1 scanned.
README badgeBadge for your project's readme fileREADME badge
[](https://nittim.com)