Loading report…
← nittim
1 critical dependency vulnerability found. 11 more dimensions need Audit for the full picture.
500 of 24408 files scanned (2%) — this snapshot was truncated: this audit's size limit was reached, so some source was left unread.
Two scanners read 500 of 24408 files, starting with the highest-priority ones: one for committed credentials, one for known vulnerabilities in your dependencies. They found 0 committed credentials on production paths and 1 high or critical vulnerability in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep Verification is the tier that issues a verdict. This scan does not.
4.2.0 — GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj
js-yaml: YAML merge-key chains can force quadratic CPU consumption — devDependency
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — devDependency
Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.
The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.
Scanned 500 of 24408 files (highest-priority subset) · discourse/discourse
Dependency manifests: 54 package roots found, 5 scanned — package list truncated at the vulnerability-lookup limit. Ruby dependencies detected — dependency-CVE scanning does not cover it yet; CVEs there are UNVERIFIED, not absent.
[](https://nittim.com/library/discourse/discourse)