Loading report…
← nittim
← nittimshared scan
shayan-shojaei/open-tutor ↗ · 48a011a · Aug 21, 2026, 11:23 PM
We found hard evidence. 6 things need your attention now.We found real evidence of problems. 6 things need your attention now.6 issues need attention now.
Free scan · deterministic evidence onlyFree scan · found by automatic checks onlyFree scan · deterministic evidence only
These are facts from deterministic scanners, not opinion — 6 high/critical dependency vulnerabilities. The full picture — architecture, AI-generated-code risk, privacy, and 11 more dimensions — needs Audit.
These are facts found by automatic checks, not opinions — 6 serious security bugs in the ready-made packages your project uses. The full picture — how your code is built, AI-generated-code risk, privacy, and 11 more areas — needs Audit.
6 critical dependency vulnerabilities found. 11 more dimensions need Audit for the full picture.
126 of 143 files scanned (88%). Nothing was cut short by a limit — the rest is mostly images, generated output, and other non-source content this audit doesn't read.
What this meansWhat this means for youWhat this means
Two scanners read 126 of 143 files: one for committed credentials, one for known vulnerabilities in your dependencies. They found 0 committed credentials on production paths and 6 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep AI is the tier that issues a verdict. This scan does not.
Read it:
Packages you ship with known vulnerabilities
cvenpm nanoid2 in 1 version
3.3.12 — GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8
nanoid: non-secure generators can loop indefinitely with negative size — HIGH
nanoid: custom generators can loop indefinitely when size is zero — HIGH
cvenpm next@14.2.35GHSA-36qx-fr4f-26g5
Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n — HIGH
cvenpm postcss@8.5.15GHSA-r28c-9q8g-f849
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure — HIGH
cvenpm shell-quote@1.8.4GHSA-395f-4hp3-45gv
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407) — HIGH
cvenpm vite@5.4.21GHSA-fx2h-pf6j-xcff
vite: `server.fs.deny` bypass on Windows alternate paths — HIGH
Worth knowing, not blocking
dev depnpm postcss4 in 2 versions
8.4.31 — GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments — devDependency
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset — devDependency
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output — devDependency
8.5.15 — GHSA-fxqj-rqcc-2cmp
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset — MODERATE
low cvenpm esbuild2 in 2 versions
0.21.5 — GHSA-67mh-4wv8-2f99
esbuild enables any website to send any requests to the development server and read the response — MODERATE
0.28.0 — GHSA-g7r4-m6w7-qqqr
esbuild allows arbitrary file read when running the development server on Windows — LOW
low cvenpm next2 in 1 version
14.2.35 — GHSA-3g8h-86w9-wvmq, GHSA-3x4c-7xq6-9pq8
Next.js's Middleware / Proxy redirects can be cache-poisoned — LOW
Next.js: Unbounded next/image disk cache growth can exhaust storage — MODERATE
moderate cvenpm vite2 in 1 version
5.4.21 — GHSA-4w7w-66w2-5vf9, GHSA-v6wh-96g9-6wx3
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling — MODERATE
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows — MODERATE
dev depnpm vitest@1.6.1GHSA-5xrq-8626-4rwp
When Vitest UI server is listening, arbitrary file can be read and executed — devDependency
AI audit for shayan-shojaei/open-tutor · all 14 dimensions · usually within 15 minutes*AI check for shayan-shojaei/open-tutor · all 14 areas · usually within 15 minutes*AI audit · shayan-shojaei/open-tutor · 14 dimensions · usually within 15 minutes*
14 things we haven't looked at yet14 things we haven't checked yet14 things unaudited
Security logic, privacy, reliability, AI-generated-code risk and 10 more — unaudited, not clean.Security logic, privacy, reliability, AI-generated-code risk and 10 more — not checked yet, which is different from safe.Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.
The free scan reasons across none of these. Absence of findings is reported as unaudited, not safe. Opus 4.8 reads the code semantically and scores every one — with evidence, business impact, and a fix per finding.
The free scan doesn't look at any of these. If nothing is flagged here, that means it wasn't checked — not that it's safe. Opus 4.8 (the AI model behind the audit) reads and understands your code and scores every one of these — with evidence, the real-world impact, and a fix for each finding.
The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.
SecurityPriority: Core
Privacy & CompliancePriority: Core
Reliability & ResiliencePriority: Core
Code Quality & ArchitecturePriority: Important
AI / Vibe Coding RiskPriority: Important
Performance & ScalabilityPriority: Important
Infrastructure & DevOpsPriority: Important
Data LayerPriority: Important
Business & Product RiskPriority: Supporting
Developer ExperiencePriority: Supporting
Accessibility & UXPriority: Supporting
ObservabilityPriority: Supporting
Maintainability ForecastPriority: Specialized
IP & Novelty ExposurePriority: Specialized
Modules run (2)
Hardcoded Secret ScanDependency Vulnerability Scan
Scanned 126 of 143 files · shayan-shojaei/open-tutor
Dependency manifests: 3 package roots found, 3 scanned; 2 Go manifests read.
README badgeBadge for your project's readme fileREADME badge
[](https://nittim.com)