Loading report…
← nittim
← nittimshared scan
grafana/grafana ↗ · ef9f33e · Aug 21, 2026, 10:39 PM
Hard evidence: 11 issues need attention now.
Free scan · deterministic evidence only
1 committed secret and 10 critical dependency vulnerabilities found. 11 more dimensions need Audit for the full picture.
485 of 22635 files scanned (2%) — this snapshot was truncated: this audit's size limit was reached, so some source was left unread.
Read 485 of 500 selected files — this repository's archive was too large to finish in one scan.
What this means
Two scanners read 485 of 22635 files, starting with the highest-priority ones: one for committed credentials, one for known vulnerabilities in your dependencies. They found 1 committed credential on production paths and 10 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep Verification is the tier that issues a verdict. This scan does not.
Read it:
Secrets committed on production paths
secretGeneric hardcoded secretdevenv/docker/blocks/influxdb/docker-compose.yaml:11
DOCKER_INFLUXDB_INIT_PASSWO…345'
Packages you ship with known vulnerabilities
cveGo github.com/grafana/tempo2 in 1 version
1.5.1-0.20260427112133-525d1bab07e0 — GHSA-ffqx-q65f-36jf, GHSA-p4r4-xvrq-gvmc
Grafana Tempo has Inadequate Encryption Strength — HIGH
Grafana Tempo has an Uncontrolled Resource Consumption issue — HIGH
cvenpm immutable2 in 1 version
5.1.5 — GHSA-v56q-mh7h-f735, GHSA-xvcm-6775-5m9r
Immutable.js `List` 32-bit trie overflow → unrecoverable DoS — HIGH
Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set — HIGH
cvenpm js-yaml2 in 1 version
4.1.0 — GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj
js-yaml: YAML merge-key chains can force quadratic CPU consumption — HIGH
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — HIGH
cvenpm lodash2 in 2 versions
4.17.21 — GHSA-r5fr-rjxr-66jc
lodash vulnerable to Code Injection via `_.template` imports key names — HIGH
4.17.23 — GHSA-r5fr-rjxr-66jc
lodash vulnerable to Code Injection via `_.template` imports key names — HIGH
cvenpm nanoid2 in 1 version
5.0.9 — GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8
nanoid: non-secure generators can loop indefinitely with negative size — HIGH
nanoid: custom generators can loop indefinitely when size is zero — HIGH
Worth knowing, not blocking
test fixtureGeneric hardcoded secretapps/provisioning/pkg/connection/oauth/extra_test.go:118
{name: "stored token is passed to the provider", token: common.RawSecureValue(`{"access_token":"stored-token"}`), wantToken:…ken"}, — non-production path
moderate cvenpm dompurify3 in 1 version
3.4.0 — GHSA-55q2-fjhq-7xh7, GHSA-76mc-f452-cxcm, GHSA-c2j3-45gr-mqc4
DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS — MODERATE
DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR` — MODERATE
DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements. — LOW
moderate cvenpm lodash3 in 2 versions
4.17.21 — GHSA-f23m-r3pf-42rh, GHSA-xxjr-mmjv-4gpg
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` — MODERATE
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions — MODERATE
4.17.23 — GHSA-f23m-r3pf-42rh
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` — MODERATE
advisory cveGo github.com/grafana/tempo@1.5.1-0.20260427112133-525d1bab07e0GO-2026-5359
Grafana Tempo has Inadequate Encryption Strength in github.com/grafana/tempo — UNKNOWN
moderate cvenpm js-yaml@4.1.0GHSA-h67p-54hq-rp68
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases — MODERATE
dev depnpm mjml@4.13.0GHSA-45h5-66jx-r2wf
MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827 — devDependency
AI audit · grafana/grafana · 14 dimensions · usually within 15 minutes*
14 things unaudited
Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.
The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.
SecurityPriority: Core
Privacy & CompliancePriority: Core
Reliability & ResiliencePriority: Core
Code Quality & ArchitecturePriority: Important
AI / Vibe Coding RiskPriority: Important
Performance & ScalabilityPriority: Important
Infrastructure & DevOpsPriority: Important
Data LayerPriority: Important
Business & Product RiskPriority: Supporting
Developer ExperiencePriority: Supporting
Accessibility & UXPriority: Supporting
ObservabilityPriority: Supporting
Maintainability ForecastPriority: Specialized
IP & Novelty ExposurePriority: Specialized
Modules run (2)
Hardcoded Secret ScanDependency Vulnerability Scan
Scanned 485 of 22635 files (highest-priority subset) · grafana/grafana
Dependency manifests: 28 package roots found, 25 scanned; 1 Python manifest read; 86 Go manifests read — package list truncated at the vulnerability-lookup limit.
README badge
[](https://nittim.com/library/grafana/grafana)