panva/jose free scan: 0 vulnerable dependencies, 0 committed secrets

panva/jose ↗ · afbc664 · Aug 21, 2026, 10:52 PM

No issues found

Free scan · deterministic evidence only

No deterministic issues found — not a clean bill of health. 14 dimensions remain unaudited. Run Audit for the verdict.

338 of 343 files scanned (98%). Nothing was cut short by a limit — the rest is mostly images, generated output, and other non-source content this audit doesn't read.

What this means

Two scanners read 338 of 343 files: one for committed credentials, one for known vulnerabilities in your dependencies. Neither found anything. That is not a clean bill of health. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep Verification is the tier that issues a verdict. This scan does not.

Read it:

Worth knowing, not blocking

43 found · 19 files · 34 in tests

Context only — test/example secrets, dev-only or moderate/low CVEs. Never verdict-forcing.

test fixtureJSON Web Token26 in 13 files

cookbook/jwe.mjs:97, :169, :345, :402, :462

:97 — 'eyJhbG…uoTQ.23i-Tb1AV4n0WKVSSgcQrdg6GRqsUKxjruHXYsTHAJLZ2nsnGIX86vMXqIi6IRsfywCRFzLxEcZBRnTvG3nhzPk0GDD7FMyXhUHpDjEYCNA_XOmzg8yZR9oyjo6lTF6si4q9FZ2EhzgFQCLO_6h — non-production path

:169 — 'eyJhbG…tnW_.tkZuOO9h95OgHJmkkrfLBisku8rGf6nzVxhRM3sVOhXgz5NJ76oID7lpnAi_cPWJRCjSpAaUZ5dOR3Spy7QuEkmKx8-3RCMhSYMzsXaEwDdXta9Mn5B7cCBoJKB0IgEnj_qfo1hIi-uEkUpOZ8a — non-production path

:345 — 'eyJhbG…woFQ.Jf5p9-ZhJlJy_IQ_byKFmI0Ro7w7G1QiaZpI8OaiVgD8EqoDZHyFKFBupS8iaEeVIgMqWmsuJKuoVgzR3YfzoMd3GxEm3VxNhzWyWtZKX0gxKdy6HgLvqoGNbZCzLjqcpDiF8q2_62EVAbr2uSc — non-production path

:402 — 'eyJhbG…c9Jo.AwliP-KmWgsZ37BvzCefNen6VTbRK3QMA4TkvRkH0tP1bTdhtFJgJxeVmJkLD61A1hnWGetdg11c9ADsnWgL56NyxwSYjU1ZEHcGkd3EkU0vjHi9gTlb90qSYFfeF0LwkcTtjbYKCsiNJQkcIp1 — non-production path

:462 — 'eyJhbG…EZIl.HbDtOsdai1oYziSx25KEeTxmwnh8L8jKMFNc1k3zmMI6VB8hry57tDZ61jXyezSPt0fdLVfe6Jf5y5-JaCap_JQBcb5opbmT60uWGml8blyiMQmOn9J--XhhlYg0m-BHaqfDO5iTOWxPxFMUedx — non-production path

cookbook/jws.mjs:32, :74, :122, :168, :213

:32 — 'eyJhbG…quDg', — non-production path

:74 — 'eyJhbG…0KAg', — non-production path

:122 — 'eyJhbG…2Eaw', — non-production path

:168 — 'eyJhbG…9xQ2', — non-production path

:213 — 'eyJhbG…d7p0', — non-production path

docs/jwe/compact/decrypt/functions/compactDecrypt.md:32

:32 — 'eyJhbG…b76X.6PcuDe5D6ttWFYyv0oqqdDXfI2R8wBg1F2Q80UUA_Gv8eEimNWfxIWdLxrjzgQGSvIhxmFKuLM0.a93_Ug3uZHuczj70Zavx8Q' — non-production path

docs/jwk/embedded/functions/EmbeddedJWK.md:35

:35 — 'eyJqd2…aV9g' — non-production path

docs/jws/compact/verify/functions/compactVerify.md:32

:32 — 'eyJhbG…5URg' — non-production path

docs/jwt/verify/functions/jwtVerify.md:44, :70, :92

:44 — 'eyJhbG…KEnI' — non-production path

:70 — 'eyJhbG…nDKg' — non-production path

:92 — 'eyJhbG…nDKg' — non-production path

src/jwe/compact/decrypt.ts:36

:36 — * 'eyJhbG…b76X.6PcuDe5D6ttWFYyv0oqqdDXfI2R8wBg1F2Q80UUA_Gv8eEimNWfxIWdLxrjzgQGSvIhxmFKuLM0.a93_Ug3uZHuczj70Zavx8Q' — non-production path

src/jwk/embedded.ts:28

:28 — * 'eyJqd2…aV9g' — non-production path

src/jws/compact/verify.ts:38

:38 — * 'eyJhbG…5URg' — non-production path

src/jwt/verify.ts:49, :77, :101

:49 — * 'eyJhbG…KEnI' — non-production path

:77 — * 'eyJhbG…nDKg' — non-production path

:101 — * 'eyJhbG…nDKg' — non-production path

test/jws/compact.sign.test.ts:17

:17 — 'eyJhbG…fUaA', — non-production path

test/jwt/sign.test.ts:24, :35

:24 — 'eyJhbG…djGo', — non-production path

:35 — 'eyJhbG…rNAk' — non-production path

test/util/decode_jwt.test.ts:7

:7 — 'eyJhbG…sw5c' — non-production path

test fixturePrivate Key block17 in 6 files

docs/jwt/sign/classes/SignJWT.md:37

:37 — const pkcs8 = `-----B…---- — non-production path

docs/key/import/functions/importPKCS8.md:35

:35 — const pkcs8 = `-----B…---- — non-production path

src/jwt/sign.ts:53

:53 — * const pkcs8 = `-----B…---- — non-production path

src/key/import.ts:135, :152

:135 — * const pkcs8 = `-----B…---- — non-production path

:152 — if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----B…----') !== 0) { — non-production path

tap/fixtures.ts:10, :39, :68, :100, :141, :205, :221, :264, :321

:10 — '-----B…----\n' + — non-production path

:39 — '-----B…----\n' + — non-production path

:68 — '-----B…----\n' + — non-production path

:100 — '-----B…----\n' + — non-production path

:141 — '-----B…----\n' + — non-production path

:205 — '-----B…----\n' + — non-production path

:221 — pkcs8: `-----B…---- — non-production path

:264 — pkcs8: `-----B…---- — non-production path

:321 — pkcs8: `-----B…---- — non-production path

tap/pem.ts:91, :112, :139

:91 — result += pem.startsWith('-----B…----') — non-production path

:112 — case pem.startsWith('-----B…----'): { — non-production path

:139 — if (pem.startsWith('-----B…----')) { — non-production path

AI audit · panva/jose · 14 dimensions · usually within 15 minutes*

Audit — your first Audit is free. After that, about $5.Needs a free GitHub or Google sign-inThe free scan stays unlimited

14 things unaudited

Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.

The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.

SecurityPriority: Core

Privacy & CompliancePriority: Core

Reliability & ResiliencePriority: Core

Code Quality & ArchitecturePriority: Important

AI / Vibe Coding RiskPriority: Important

Performance & ScalabilityPriority: Important

Infrastructure & DevOpsPriority: Important

Data LayerPriority: Important

Business & Product RiskPriority: Supporting

Developer ExperiencePriority: Supporting

Accessibility & UXPriority: Supporting

ObservabilityPriority: Supporting

Maintainability ForecastPriority: Specialized

IP & Novelty ExposurePriority: Specialized

Modules run (2)

Hardcoded Secret ScanDependency Vulnerability Scan

Hover a module for why it was selected. See every check nittim can run.

Scanned 338 of 343 files · panva/jose
Dependency manifests: 1 package root found, 1 scanned.

README badge

[![nittim](https://nittim.com/api/badge/panva/jose)](https://nittim.com/library/panva/jose)