appwrite/appwrite free scan: 13 vulnerable dependencies, 4 committed secrets

appwrite/appwrite ↗ · 0cefd06 · Aug 21, 2026, 10:33 PM

Hard evidence: 4 issues need attention now.

Free scan · deterministic evidence only

4 committed secrets found. 11 more dimensions need Audit for the full picture.

500 of 3118 files scanned (16%) — this snapshot was truncated: this audit's size limit was reached, so some source was left unread.

What this means

Two scanners read 500 of 3118 files, starting with the highest-priority ones: one for committed credentials, one for known vulnerabilities in your dependencies. They found 4 committed credentials on production paths and 0 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep Verification is the tier that issues a verdict. This scan does not.

Read it:

Secrets committed on production paths

4 found · 3 files

secretPrivate Key block3 in 2 files

src/Appwrite/Platform/Modules/Project/Http/Project/OAuth2/Apple/Update.php:99, :135

:99 — 'example' => '-----B…----MIGTAg...jy2Xbna-----END PRIVATE KEY-----',

:135 — ->param('p8File', null, new Nullable(new Text(4096, 0)), 'Contents of the Apple OAuth2 app .p8 private key file. The secret key wrapped by the PEM markers is 20

src/Appwrite/Utopia/Response/Model/OAuth2Apple.php:80

:80 — 'example' => '-----B…----MIGTAg...jy2Xbna-----END PRIVATE KEY-----',

secretJSON Web Tokensrc/Appwrite/Utopia/Response/Model/ResourceToken.php:51

'example' => 'eyJhbG…sw5c',

Worth knowing, not blocking

31 found · 11 files · 8 packages · 18 in tests

Context only — test/example secrets, dev-only or moderate/low CVEs. Never verdict-forcing.

test fixtureGeneric hardcoded secret17 in 10 files

tests/e2e/Services/Project/AuthMethodsIntegrationTest.php:66

:66 — $passwo…234'; — non-production path

tests/e2e/Services/Project/PoliciesPasswordHistoryIntegrationTest.php:37, :38, :39, :40, :127

:37 — $firstPasswo…ord'; — non-production path

:38 — $secondPasswo…ord'; — non-production path

:39 — $thirdPasswo…ord'; — non-production path

:40 — $fourthPasswo…ord'; — non-production path

:127 — $fifthPasswo…ord'; — non-production path

tests/e2e/Services/Project/PoliciesSessionAlertIntegrationTest.php:22

:22 — $passwo…234'; — non-production path

tests/e2e/Services/Project/PoliciesSessionDurationIntegrationTest.php:49

:49 — $passwo…234'; — non-production path

tests/e2e/Services/Project/PoliciesSessionInvalidationIntegrationTest.php:62, :89, :104

:62 — $firstPasswo…ord'; — non-production path

:89 — $secondPasswo…ord'; — non-production path

:104 — $thirdPasswo…ord'; — non-production path

tests/e2e/Services/Project/PoliciesSessionLimitIntegrationTest.php:36

:36 — $passwo…234'; — non-production path

tests/e2e/Services/ProjectWebhooks/WebhooksCustomClientTest.php:853

:853 — $passwo…rd2'; — non-production path

tests/e2e/Services/Webhooks/WebhooksBase.php:763, :807

:763 — $newSecret…ion'; — non-production path

:807 — $customSecret…key'; — non-production path

tests/unit/Auth/OAuth2/PKCETest.php:18

:18 — private const APP_SECRET…ret'; — non-production path

tests/unit/Utopia/Messaging/Adapter/WebhookTest.php:48

:48 — $secret…ret'; — non-production path

test fixturePrivate Key blocktests/e2e/Services/Project/OAuth2Base.php:232

'p8File' => '-----B…----TEST-----END PRIVATE KEY-----', — non-production path

dev depnpm astro3 in 1 version

6.4.4 — GHSA-2pvr-wf23-7pc7, GHSA-4g3v-8h47-v7g6, GHSA-7pw4-f3q4-r2p2

Astro: Host header SSRF in prerendered error page fetch — devDependency

Astro: Reflected XSS via unescaped View Transition animation properties — devDependency

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands — devDependency

dev depnpm js-yaml2 in 1 version

4.2.0 — GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj

js-yaml: YAML merge-key chains can force quadratic CPU consumption — devDependency

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — devDependency

dev depnpm nanoid2 in 1 version

3.3.12 — GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8

nanoid: non-secure generators can loop indefinitely with negative size — devDependency

nanoid: custom generators can loop indefinitely when size is zero — devDependency

dev depnpm postcss2 in 1 version

8.5.15 — GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset — devDependency

PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure — devDependency

dev depnpm @astrojs/node@10.1.3GHSA-r557-wffq-wvrc

@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect — devDependency

dev depnpm esbuild@0.27.7GHSA-g7r4-m6w7-qqqr

esbuild allows arbitrary file read when running the development server on Windows — devDependency

dev depnpm sharp@0.34.5GHSA-f88m-g3jw-g9cj

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 — devDependency

dev depnpm svgo@4.0.1GHSA-2p49-hgcm-8545

SVGO removeScripts plugin leaves some executable scripts intact — devDependency

AI audit · appwrite/appwrite · 14 dimensions · usually within 15 minutes*

Audit — your first Audit is free. After that, about $5.Needs a free GitHub or Google sign-inThe free scan stays unlimited

14 things unaudited

Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.

The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.

SecurityPriority: Core

Privacy & CompliancePriority: Core

Reliability & ResiliencePriority: Core

Code Quality & ArchitecturePriority: Important

AI / Vibe Coding RiskPriority: Important

Performance & ScalabilityPriority: Important

Infrastructure & DevOpsPriority: Important

Data LayerPriority: Important

Business & Product RiskPriority: Supporting

Developer ExperiencePriority: Supporting

Accessibility & UXPriority: Supporting

ObservabilityPriority: Supporting

Maintainability ForecastPriority: Specialized

IP & Novelty ExposurePriority: Specialized

Modules run (2)

Hardcoded Secret ScanDependency Vulnerability Scan

Hover a module for why it was selected. See every check nittim can run.

Scanned 500 of 3118 files (highest-priority subset) · appwrite/appwrite
Dependency manifests: 6 package roots found, 6 scanned. PHP dependencies detected — dependency-CVE scanning does not cover it yet; CVEs there are UNVERIFIED, not absent.

README badge

nittim verdict badge for appwrite/appwrite

[![nittim](https://nittim.com/api/badge/appwrite/appwrite)](https://nittim.com/library/appwrite/appwrite)