directus/directus free scan: 6 vulnerable dependencies, 0 committed secrets

directus/directus ↗ · 2abb57f · Aug 21, 2026, 10:22 PM

No issues found

Free scan · deterministic evidence only

No deterministic issues found — not a clean bill of health. 14 dimensions remain unaudited. Run Audit for the verdict.

500 of 4625 files scanned (10%) — this snapshot was truncated: this audit's size limit was reached, so some source was left unread.

What this means

Two scanners read 500 of 4625 files, starting with the highest-priority ones: one for committed credentials, one for known vulnerabilities in your dependencies. Neither found anything. That is not a clean bill of health. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep Verification is the tier that issues a verdict. This scan does not.

Read it:

Worth knowing, not blocking

90 found · 12 files · 4 packages · 84 in tests

Context only — test/example secrets, dev-only or moderate/low CVEs. Never verdict-forcing.

test fixtureGeneric hardcoded secret84 in 12 files

api/src/ai/chat/controllers/chat.post.test.ts:45, :46, :247, :248

:45 — openaiApiKey…key', — non-production path

:46 — anthropicApiKey…key', — non-production path

:247 — openaiApiKey…key', — non-production path

:248 — anthropicApiKey…key', — non-production path

api/src/ai/chat/controllers/object.post.test.ts:61, :62

:61 — openaiApiKey…key', — non-production path

:62 — anthropicApiKey…key', — non-production path

api/src/ai/chat/lib/create-ui-stream.test.ts:55

:55 — anthropicApiKey…key', — non-production path

api/src/ai/chat/middleware/load-settings.test.ts:36, :37, :38, :39, :74, :75, :76, :77, :137, :156

:36 — ai_openai_api_ke…key', — non-production path

:37 — ai_anthropic_api_ke…key', — non-production path

:38 — ai_google_api_ke…key', — non-production path

:39 — ai_openai_compatible_api_ke…key', — non-production path

:74 — openaiApiKey…key', — non-production path

:75 — anthropicApiKey…key', — non-production path

:76 — googleApiKey…key', — non-production path

:77 — openaiCompatibleApiKey…key', — non-production path

:137 — ai_openai_api_ke…key', — non-production path

:156 — openaiApiKey…key', — non-production path

api/src/ai/files/adapters/google.test.ts:29

:29 — const mockApiKey…key'; — non-production path

api/src/ai/files/controllers/upload.test.ts:69, :70, :71

:69 — openaiApiKey…key', — non-production path

:70 — anthropicApiKey…key', — non-production path

:71 — googleApiKey…key', — non-production path

api/src/ai/files/lib/upload-to-provider.test.ts:71, :87, :105

:71 — const settings = { ...baseSettings, openaiApiKey…key' }; — non-production path

:87 — const settings = { ...baseSettings, anthropicApiKey…key' }; — non-production path

:105 — const settings = { ...baseSettings, googleApiKey…key' }; — non-production path

api/src/ai/providers/registry.test.ts:59, :63, :69, :73, :79, :83, :124, :147, :225

:59 — openaiApiKey…key', — non-production path

:63 — expect(configs[0]).toEqual({ type: 'openai', apiKey…key' }); — non-production path

:69 — anthropicApiKey…key', — non-production path

:73 — expect(configs[0]).toEqual({ type: 'anthropic', apiKey…key' }); — non-production path

:79 — googleApiKey…key', — non-production path

:83 — expect(configs[0]).toEqual({ type: 'google', apiKey…key' }); — non-production path

:124 — anthropicApiKey…pic', — non-production path

:147 — const configs: ProviderConfig[] = [{ type: 'anthropic', apiKey…pic' }]; — non-production path

:225 — { type: 'anthropic', apiKey…pic' }, — non-production path

api/src/auth/drivers/ldap.test.ts:163, :377, :1073, :1074, :1084, :1086, :1118, :1119, :1153, :1154, :1214, :1215

:163 — bindPasswo…ord', — non-production path

:377 — await driver.login(user, { passwo…ord' }); — non-production path

:1073 — accessToken:…ken', — non-production path

:1074 — refreshToken:…ken', — non-production path

:1084 — access_token:…ken', — non-production path

:1086 — refresh_token:…ken', — non-production path

:1118 — accessToken:…ken', — non-production path

:1119 — refreshToken:…ken', — non-production path

:1153 — accessToken:…ken', — non-production path

:1154 — refreshToken:…ken', — non-production path

:1214 — accessToken:…ken', — non-production path

:1215 — refreshToken:…ken', — non-production path

api/src/auth/drivers/oauth2.test.ts:141, :396, :429, :460, :492, :531, :573, :612, :790, :791, :813, :827, :867, :907, :1127, :1166, :1178, :1189, :1213, :1230

:141 — client…ret', — non-production path

:396 — access_token:…ken', — non-production path

:429 — access_token:…ken', — non-production path

:460 — const mockTokenSet = { access_token:…123' }; — non-production path

:492 — access_token:…ken', — non-production path

:531 — access_token:…ken', — non-production path

:573 — const mockTokenSet = { access_token:…ken' }; — non-production path

:612 — const mockTokenSet = { access_token:…ken' }; — non-production path

:790 — access_token:…ken', — non-production path

:791 — refresh_token:…123', — non-production path

:813 — auth_data: JSON.stringify({ refreshToken:…123' }), — non-production path

:827 — access_token:…ken', — non-production path

:867 — refresh_token:…ken', — non-production path

:907 — refresh_token:…ken', — non-production path

:1127 — auth_data: JSON.stringify({ refreshToken:…ken' }), — non-production path

:1166 — auth_data: { refreshToken:…ken' }, — non-production path

:1178 — const mockTokenSet = { access_token: 'new-token', refresh_token:…ken' }; — non-production path

:1189 — auth_data: { refreshToken:…ken' }, — non-production path

:1213 — auth_data: { refreshToken:…ken' }, — non-production path

:1230 — auth_data: { refreshToken:…ken' }, — non-production path

api/src/auth/drivers/openid.test.ts:143, :389, :635, :678, :679, :704, :797, :798, :1042, :1087, :1101, :1112, :1139, :1158

:143 — client…ret', — non-production path

:389 — access_token:…ken', — non-production path

:635 — access_token:…ken', — non-production path

:678 — access_token:…ken', — non-production path

:679 — refresh_token:…123', — non-production path

:704 — auth_data: JSON.stringify({ refreshToken:…123' }), — non-production path

:797 — access_token:…ken', — non-production path

:798 — refresh_token:…ken', — non-production path

:1042 — auth_data: JSON.stringify({ refreshToken:…ken' }), — non-production path

:1087 — auth_data: { refreshToken:…ken' }, — non-production path

:1101 — const mockTokenSet = { access_token: 'new-token', refresh_token:…ken' }; — non-production path

:1112 — auth_data: { refreshToken:…ken' }, — non-production path

:1139 — auth_data: { refreshToken:…ken' }, — non-production path

:1158 — auth_data: { refreshToken:…ken' }, — non-production path

api/src/controllers/mcp/oauth.test.ts:459, :539, :619, :672, :697

:459 — client…lue', — non-production path

:539 — refresh_token:…ken', — non-production path

:619 — token:…ken', — non-production path

:672 — token:…ken', — non-production path

:697 — token:…ken', — non-production path

dev depnpm dompurify3 in 1 version

3.3.2 — GHSA-39q2-94rc-95cp, GHSA-55q2-fjhq-7xh7, GHSA-76mc-f452-cxcm

DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation — devDependency

DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS — devDependency

DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR` — devDependency

low cvenpm @babel/core@7.28.4GHSA-4x5r-pxfx-6jf8

@babel/core: Arbitrary File Read via sourceMappingURL Comment — LOW

dev depnpm diff@7.0.0GHSA-73rr-hh4g-fpgx

jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch — devDependency

low cvenpm pm2@6.0.14GHSA-x5gf-qvw8-r2rm

pm2 Regular Expression Denial of Service vulnerability — LOW

AI audit · directus/directus · 14 dimensions · usually within 15 minutes*

Audit — your first Audit is free. After that, about $5.Needs a free GitHub or Google sign-inThe free scan stays unlimited

14 things unaudited

Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.

The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.

SecurityPriority: Core

Privacy & CompliancePriority: Core

Reliability & ResiliencePriority: Core

Code Quality & ArchitecturePriority: Important

AI / Vibe Coding RiskPriority: Important

Performance & ScalabilityPriority: Important

Infrastructure & DevOpsPriority: Important

Data LayerPriority: Important

Business & Product RiskPriority: Supporting

Developer ExperiencePriority: Supporting

Accessibility & UXPriority: Supporting

ObservabilityPriority: Supporting

Maintainability ForecastPriority: Specialized

IP & Novelty ExposurePriority: Specialized

Modules run (2)

Hardcoded Secret ScanDependency Vulnerability Scan

Hover a module for why it was selected. See every check nittim can run.

Scanned 500 of 4625 files (highest-priority subset) · directus/directus
Dependency manifests: 43 package roots found, 13 scanned — package list truncated at the vulnerability-lookup limit.

README badge

nittim verdict badge for directus/directus

[![nittim](https://nittim.com/api/badge/directus/directus)](https://nittim.com/library/directus/directus)