Loading report…
← nittim
← nittimshared scan
0-x-joseph/freelanceros ↗ · 06eab8c · Aug 21, 2026, 11:24 PM
We found hard evidence. 17 things need your attention now.We found real evidence of problems. 17 things need your attention now.17 issues need attention now.
Free scan · deterministic evidence onlyFree scan · found by automatic checks onlyFree scan · deterministic evidence only
These are facts from deterministic scanners, not opinion — 17 high/critical dependency vulnerabilities. The full picture — architecture, AI-generated-code risk, privacy, and 11 more dimensions — needs Audit.
These are facts found by automatic checks, not opinions — 17 serious security bugs in the ready-made packages your project uses. The full picture — how your code is built, AI-generated-code risk, privacy, and 11 more areas — needs Audit.
17 critical dependency vulnerabilities found. 11 more dimensions need Audit for the full picture.
140 of 149 files scanned (93%). Nothing was cut short by a limit — the rest is mostly images, generated output, and other non-source content this audit doesn't read.
What this meansWhat this means for youWhat this means
Two scanners read 140 of 149 files: one for committed credentials, one for known vulnerabilities in your dependencies. They found 0 committed credentials on production paths and 17 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep AI is the tier that issues a verdict. This scan does not.
Read it:
Packages you ship with known vulnerabilities
cvenpm minimatch3 in 1 version
3.1.2 — GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions — HIGH
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern — HIGH
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments — HIGH
cvenpm brace-expansion2 in 1 version
1.1.11 — GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — HIGH
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — HIGH
cvenpm flatted2 in 1 version
3.3.1 — GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh
flatted vulnerable to unbounded recursion DoS in parse() revive phase — HIGH
Prototype Pollution via parse() in NodeJS flatted — HIGH
cvenpm js-yaml2 in 1 version
4.1.0 — GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj
js-yaml: YAML merge-key chains can force quadratic CPU consumption — HIGH
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — HIGH
cvenpm nanoid2 in 1 version
3.3.7 — GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8
nanoid: non-secure generators can loop indefinitely with negative size — HIGH
nanoid: custom generators can loop indefinitely when size is zero — HIGH
cvenpm cross-spawn@7.0.3GHSA-3xgq-45jj-v275
Regular Expression Denial of Service (ReDoS) in cross-spawn — HIGH
cvenpm lodash@4.17.21GHSA-r5fr-rjxr-66jc
lodash vulnerable to Code Injection via `_.template` imports key names — HIGH
cvenpm next@13.5.1GHSA-36qx-fr4f-26g5
Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n — HIGH
cvenpm picomatch@2.3.1GHSA-c2c7-rcm5-vvqj
Picomatch has a ReDoS vulnerability via extglob quantifiers — HIGH
cvenpm postcss@8.4.30GHSA-6g55-p6wh-862q
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments — HIGH
cvenpm ws@8.18.2GHSA-96hv-2xvq-fx4p
ws: Memory exhaustion DoS from tiny fragments and data chunks — HIGH
Worth knowing, not blocking
moderate cvenpm qs3 in 1 version
6.14.0 — GHSA-6rw7-vpxm-498p, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion — MODERATE
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set — MODERATE
qs's arrayLimit bypass in comma parsing allows denial of service — LOW
moderate cvenpm lodash2 in 1 version
4.17.21 — GHSA-f23m-r3pf-42rh, GHSA-xxjr-mmjv-4gpg
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` — MODERATE
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions — MODERATE
low cvenpm next2 in 1 version
13.5.1 — GHSA-3g8h-86w9-wvmq, GHSA-3h52-269p-cp9r
Next.js's Middleware / Proxy redirects can be cache-poisoned — LOW
Information exposure in Next.js dev server due to lack of origin verification — LOW
moderate cvenpm postcss2 in 1 version
8.4.30 — GHSA-7fh5-64p2-3v2j, GHSA-fxqj-rqcc-2cmp
PostCSS line return parsing error — MODERATE
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset — MODERATE
moderate cvenpm @babel/runtime@7.25.7GHSA-968p-4wvh-cqc8
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups — MODERATE
moderate cvenpm ajv@6.12.6GHSA-2g4f-4pwh-qvx6
ajv has ReDoS when using `$data` option — MODERATE
moderate cvenpm brace-expansion@1.1.11GHSA-f886-m6hf-6m8v
brace-expansion: Zero-step sequence causes process hang and memory exhaustion — MODERATE
moderate cvenpm js-yaml@4.1.0GHSA-h67p-54hq-rp68
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases — MODERATE
moderate cvenpm nanoid@3.3.7GHSA-mwcw-c2x4-8c55
Predictable results in nanoid generation when given non-integer values — MODERATE
moderate cvenpm picomatch@2.3.1GHSA-3v7f-55p6-f55p
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching — MODERATE
moderate cvenpm uuid@10.0.0GHSA-w5hq-g745-h8pq
uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided — MODERATE
moderate cvenpm ws@8.18.2GHSA-58qx-3vcg-4xpx
ws: Uninitialized memory disclosure — MODERATE
moderate cvenpm yaml@2.5.1GHSA-48c2-rrv3-qjmp
yaml is vulnerable to Stack Overflow via deeply nested YAML collections — MODERATE
AI audit for 0-x-joseph/freelanceros · all 14 dimensions · usually within 15 minutes*AI check for 0-x-joseph/freelanceros · all 14 areas · usually within 15 minutes*AI audit · 0-x-joseph/freelanceros · 14 dimensions · usually within 15 minutes*
14 things we haven't looked at yet14 things we haven't checked yet14 things unaudited
Security logic, privacy, reliability, AI-generated-code risk and 10 more — unaudited, not clean.Security logic, privacy, reliability, AI-generated-code risk and 10 more — not checked yet, which is different from safe.Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.
The free scan reasons across none of these. Absence of findings is reported as unaudited, not safe. Opus 4.8 reads the code semantically and scores every one — with evidence, business impact, and a fix per finding.
The free scan doesn't look at any of these. If nothing is flagged here, that means it wasn't checked — not that it's safe. Opus 4.8 (the AI model behind the audit) reads and understands your code and scores every one of these — with evidence, the real-world impact, and a fix for each finding.
The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.
SecurityPriority: Core
Privacy & CompliancePriority: Core
Reliability & ResiliencePriority: Core
Code Quality & ArchitecturePriority: Important
AI / Vibe Coding RiskPriority: Important
Performance & ScalabilityPriority: Important
Infrastructure & DevOpsPriority: Important
Data LayerPriority: Important
Business & Product RiskPriority: Supporting
Developer ExperiencePriority: Supporting
Accessibility & UXPriority: Supporting
ObservabilityPriority: Supporting
Maintainability ForecastPriority: Specialized
IP & Novelty ExposurePriority: Specialized
Modules run (2)
Hardcoded Secret ScanDependency Vulnerability Scan
Scanned 140 of 149 files · 0-x-joseph/freelanceros
Dependency manifests: 1 package root found, 1 scanned.
README badgeBadge for your project's readme fileREADME badge
[](https://nittim.com)