formbricks/formbricks free scan: 0 vulnerable dependencies, 0 committed secrets

formbricks/formbricks ↗ · ab8fc21 · Aug 21, 2026, 10:24 PM

No issues found

Free scan · deterministic evidence only

No deterministic issues found — not a clean bill of health. 14 dimensions remain unaudited. Run Audit for the verdict.

500 of 4685 files scanned (10%) — this snapshot was truncated: this audit's size limit was reached, so some source was left unread.

What this means

Two scanners read 500 of 4685 files, starting with the highest-priority ones: one for committed credentials, one for known vulnerabilities in your dependencies. Neither found anything. That is not a clean bill of health. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep Verification is the tier that issues a verdict. This scan does not.

Read it:

Worth knowing, not blocking

27 found · 8 files · 27 in tests

Context only — test/example secrets, dev-only or moderate/low CVEs. Never verdict-forcing.

test fixtureGeneric hardcoded secret25 in 8 files

.github/workflows/docker-build-validation.yml:183

:183 — -e AI_AZURE_API_KE…nel" \ — non-production path

apps/web/app/api/auth/[...all]/route.test.ts:117

:117 — const token …001"; — non-production path

apps/web/app/api/v1/management/responses/lib/response.test.ts:92, :94, :101

:92 — GITHUB_SECRET…bID", — non-production path

:94 — GOOGLE_CLIENT…ret", — non-production path

:101 — OIDC_CLIENT…ret", — non-production path

apps/web/app/api/v2/client/[workspaceId]/responses/lib/response.test.ts:35, :37, :39, :42

:35 — GITHUB_SECRET…ret", — non-production path

:37 — GOOGLE_CLIENT…ret", — non-production path

:39 — AZUREAD_CLIENT…ret", — non-production path

:42 — OIDC_CLIENT…ret", — non-production path

apps/web/app/api/v3/workspaces/lib/operations.test.ts:32

:32 — config: { secret…eak" }, — non-production path

apps/web/lib/auth.test.ts:29, :40, :51

:29 — const passwo…123"; — non-production path

:40 — const passwo…123"; — non-production path

:51 — const passwo…123"; — non-production path

apps/web/lib/crypto.test.ts:35, :49, :50, :62, :78, :89, :186, :195, :202

:35 — const secret…123"; — non-production path

:49 — const secret…123"; — non-production path

:50 — const wrongSecret…ret"; — non-production path

:62 — const secret…123"; — non-production path

:78 — const secret…123"; — non-production path

:89 — const secret…123"; — non-production path

:186 — secret…ens", — non-production path

:195 — secret…9-_", — non-production path

:202 — secret…5P6", — non-production path

apps/web/lib/user/password.test.ts:28, :53, :62

:28 — mockPrismaAccountFindUnique.mockResolvedValue({ passwo…ord" } as any); — non-production path

:53 — mockPrismaAccountFindUnique.mockResolvedValue({ passwo…ord" } as any); — non-production path

:62 — mockPrismaAccountFindUnique.mockResolvedValue({ passwo…ord" } as any); — non-production path

advisoryDatabase connection string2 in 1 file

.github/workflows/docker-build-validation.yml:100, :242

:100 — -e DATABASE_URL="postgr…5432/formbricks" — non-production path

:242 — -e DATABASE_URL="postgr…5432/formbricks" \ — non-production path

AI audit · formbricks/formbricks · 14 dimensions · usually within 15 minutes*

Audit — your first Audit is free. After that, about $5.Needs a free GitHub or Google sign-inThe free scan stays unlimited

14 things unaudited

Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.

The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.

SecurityPriority: Core

Privacy & CompliancePriority: Core

Reliability & ResiliencePriority: Core

Code Quality & ArchitecturePriority: Important

AI / Vibe Coding RiskPriority: Important

Performance & ScalabilityPriority: Important

Infrastructure & DevOpsPriority: Important

Data LayerPriority: Important

Business & Product RiskPriority: Supporting

Developer ExperiencePriority: Supporting

Accessibility & UXPriority: Supporting

ObservabilityPriority: Supporting

Maintainability ForecastPriority: Specialized

IP & Novelty ExposurePriority: Specialized

Modules run (2)

Hardcoded Secret ScanDependency Vulnerability Scan

Hover a module for why it was selected. See every check nittim can run.

Scanned 500 of 4685 files (highest-priority subset) · formbricks/formbricks
Dependency manifests: 21 package roots found, 5 scanned — package list truncated at the vulnerability-lookup limit.

README badge

nittim verdict badge for formbricks/formbricks

[![nittim](https://nittim.com/api/badge/formbricks/formbricks)](https://nittim.com/library/formbricks/formbricks)