Loading report…
← nittim
← nittimshared scan
sandydargoport/prism ↗ · 5988c56 · Aug 21, 2026, 11:22 PM
Hard evidence: 7 issues need attention now.
Free scan · deterministic evidence only
1 committed secret and 6 critical dependency vulnerabilities found. 11 more dimensions need Audit for the full picture.
500 of 1159 files scanned (43%) — this snapshot was truncated: this audit's size limit was reached, so some source was left unread.
What this means
Two scanners read 500 of 1159 files, starting with the highest-priority ones: one for committed credentials, one for known vulnerabilities in your dependencies. They found 1 committed credential on production paths and 6 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep AI is the tier that issues a verdict. This scan does not.
Read it:
Secrets committed on production paths
secretGeneric hardcoded secret.mcp/smoke.mjs:22
PRISM_API_TOKEN:…ken',
Packages you ship with known vulnerabilities
cvenpm basic-ftp3 in 1 version
5.2.0 — GHSA-6v7q-wjvx-w8wg, GHSA-chqc-8p9q-pq6q, GHSA-rp42-5vxx-qpwr
basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands — HIGH
basic-ftp has FTP Command Injection via CRLF — HIGH
basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list() — HIGH
cvenpm brace-expansion2 in 1 version
1.1.12 — GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — HIGH
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — HIGH
cvenpm @babel/plugin-transform-modules-systemjs@7.29.0GHSA-fv7c-fp4j-7gwp
@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input — HIGH
Worth knowing, not blocking
test fixtureGeneric hardcoded secretsrc/lib/utils/__tests__/crypto.test.ts:144
const oauthToken …ere'; — non-production path
low cvenpm @babel/core@7.28.6GHSA-4x5r-pxfx-6jf8
@babel/core: Arbitrary File Read via sourceMappingURL Comment — LOW
moderate cvenpm ajv@6.12.6GHSA-2g4f-4pwh-qvx6
ajv has ReDoS when using `$data` option — MODERATE
moderate cvenpm brace-expansion@1.1.12GHSA-f886-m6hf-6m8v
brace-expansion: Zero-step sequence causes process hang and memory exhaustion — MODERATE
AI audit · sandydargoport/prism · 14 dimensions · usually within 15 minutes*
14 things unaudited
Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.
The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.
SecurityPriority: Core
Privacy & CompliancePriority: Core
Reliability & ResiliencePriority: Core
Code Quality & ArchitecturePriority: Important
AI / Vibe Coding RiskPriority: Important
Performance & ScalabilityPriority: Important
Infrastructure & DevOpsPriority: Important
Data LayerPriority: Important
Business & Product RiskPriority: Supporting
Developer ExperiencePriority: Supporting
Accessibility & UXPriority: Supporting
ObservabilityPriority: Supporting
Maintainability ForecastPriority: Specialized
IP & Novelty ExposurePriority: Specialized
Modules run (2)
Hardcoded Secret ScanDependency Vulnerability Scan
Scanned 500 of 1159 files (highest-priority subset) · sandydargoport/prism
Dependency manifests: 2 package roots found, 2 scanned — package list truncated at the vulnerability-lookup limit.
README badge
[](https://nittim.com/library/sandydargoport/prism)