Loading report…
← nittim
← nittimshared scan
Sathyamoorthy17/master-quiz-nexus ↗ · eb2bc47 · Aug 21, 2026, 11:20 PM
We found hard evidence. 8 things need your attention now.We found real evidence of problems. 8 things need your attention now.8 issues need attention now.
Free scan · deterministic evidence onlyFree scan · found by automatic checks onlyFree scan · deterministic evidence only
These are facts from deterministic scanners, not opinion — 1 committed production secret and 7 high/critical dependency vulnerabilities. The full picture — architecture, AI-generated-code risk, privacy, and 11 more dimensions — needs Audit.
These are facts found by automatic checks, not opinions — 1 password or key found in code that ships to production and 7 serious security bugs in the ready-made packages your project uses. The full picture — how your code is built, AI-generated-code risk, privacy, and 11 more areas — needs Audit.
1 committed secret and 7 critical dependency vulnerabilities found. 11 more dimensions need Audit for the full picture.
82 of 87 files scanned (94%). Nothing was cut short by a limit — the rest is mostly images, generated output, and other non-source content this audit doesn't read.
What this meansWhat this means for youWhat this means
Two scanners read 82 of 87 files: one for committed credentials, one for known vulnerabilities in your dependencies. They found 1 committed credential on production paths and 7 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep AI is the tier that issues a verdict. This scan does not.
Read it:
Secrets committed on production paths
secretGoogle API Keysrc/lib/firebase.ts:7
apiKey: "AIzaSy…R6lw",
Packages you ship with known vulnerabilities
cvenpm @grpc/grpc-js2 in 1 version
1.9.15 — GHSA-5375-pq7m-f5r2, GHSA-99f4-grh7-6pcq
@grpc/grpc-js: A malformed request can cause a server crash — HIGH
@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash — HIGH
cvenpm protobufjs2 in 1 version
7.5.4 — GHSA-66ff-xgx4-vchm, GHSA-685m-2w69-288q
protobuf.js: Code injection through bytes field defaults in generated toObject code — HIGH
protobuf.js: Denial of service through unbounded protobuf recursion — HIGH
cvenpm @remix-run/router@1.23.0GHSA-2w69-qvjg-hvjx
React Router vulnerable to XSS via Open Redirects — HIGH
cvenpm lodash@4.17.21GHSA-r5fr-rjxr-66jc
lodash vulnerable to Code Injection via `_.template` imports key names — HIGH
cvenpm websocket-driver@0.7.4GHSA-xv26-6w52-cph6
websocket-driver: Message corruption via abuse of protocol length headers — CRITICAL
Worth knowing, not blocking
dev depnpm brace-expansion3 in 1 version
1.1.12 — GHSA-3jxr-9vmj-r5cp, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — devDependency
brace-expansion: Zero-step sequence causes process hang and memory exhaustion — devDependency
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — devDependency
dev depnpm js-yaml3 in 1 version
4.1.0 — GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68
js-yaml: YAML merge-key chains can force quadratic CPU consumption — devDependency
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — devDependency
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases — devDependency
dev depnpm minimatch3 in 1 version
3.1.2 — GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions — devDependency
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern — devDependency
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments — devDependency
dev depnpm postcss3 in 1 version
8.5.6 — GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93
PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments — devDependency
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset — devDependency
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output — devDependency
moderate cvenpm react-router3 in 1 version
6.30.1 — GHSA-2j2x-hqr9-3h42, GHSA-337j-9hxr-rhxg, GHSA-9jcx-v3wj-wh4m
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation — MODERATE
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration — MODERATE
React Router has unexpected external redirect via untrusted paths — MODERATE
dev depnpm vite3 in 1 version
5.4.19 — GHSA-4w7w-66w2-5vf9, GHSA-93m4-6634-74q7, GHSA-fx2h-pf6j-xcff
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling — devDependency
vite allows server.fs.deny bypass via backslash on Windows — devDependency
vite: `server.fs.deny` bypass on Windows alternate paths — devDependency
dev depnpm flatted2 in 1 version
3.3.1 — GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh
flatted vulnerable to unbounded recursion DoS in parse() revive phase — devDependency
Prototype Pollution via parse() in NodeJS flatted — devDependency
moderate cvenpm lodash2 in 1 version
4.17.21 — GHSA-f23m-r3pf-42rh, GHSA-xxjr-mmjv-4gpg
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` — MODERATE
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions — MODERATE
dev depnpm nanoid2 in 1 version
3.3.11 — GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8
nanoid: non-secure generators can loop indefinitely with negative size — devDependency
nanoid: custom generators can loop indefinitely when size is zero — devDependency
dev depnpm picomatch2 in 1 version
2.3.1 — GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching — devDependency
Picomatch has a ReDoS vulnerability via extglob quantifiers — devDependency
moderate cvenpm @protobufjs/utf8@1.1.0GHSA-q6x5-8v7m-xcrf
protobufjs has overlong UTF-8 decoding — MODERATE
moderate cvenpm @remix-run/router@1.23.0GHSA-2j2x-hqr9-3h42
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation — MODERATE
dev depnpm ajv@6.12.6GHSA-2g4f-4pwh-qvx6
ajv has ReDoS when using `$data` option — devDependency
dev depnpm esbuild@0.21.5GHSA-67mh-4wv8-2f99
esbuild enables any website to send any requests to the development server and read the response — devDependency
dev depnpm glob@10.4.5GHSA-5j98-mcp5-4vw2
glob CLI: Command injection via -c/--cmd executes matches with shell:true — devDependency
moderate cvenpm protobufjs@7.5.4GHSA-2pr8-phx7-x9h3
protobuf.js: Denial of service from crafted field names in generated code — MODERATE
dev depnpm rollup@4.24.0GHSA-mw96-cpmx-2vgc
Rollup 4 has Arbitrary File Write via Path Traversal — devDependency
moderate cvenpm websocket-driver@0.7.4GHSA-mp7j-qc5w-4988
websocket-driver: Resource limit bypass via message compression — MODERATE
dev depnpm yaml@2.6.0GHSA-48c2-rrv3-qjmp
yaml is vulnerable to Stack Overflow via deeply nested YAML collections — devDependency
AI audit for Sathyamoorthy17/master-quiz-nexus · all 14 dimensions · usually within 15 minutes*AI check for Sathyamoorthy17/master-quiz-nexus · all 14 areas · usually within 15 minutes*AI audit · Sathyamoorthy17/master-quiz-nexus · 14 dimensions · usually within 15 minutes*
14 things we haven't looked at yet14 things we haven't checked yet14 things unaudited
Security logic, privacy, reliability, AI-generated-code risk and 10 more — unaudited, not clean.Security logic, privacy, reliability, AI-generated-code risk and 10 more — not checked yet, which is different from safe.Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.
The free scan reasons across none of these. Absence of findings is reported as unaudited, not safe. Opus 4.8 reads the code semantically and scores every one — with evidence, business impact, and a fix per finding.
The free scan doesn't look at any of these. If nothing is flagged here, that means it wasn't checked — not that it's safe. Opus 4.8 (the AI model behind the audit) reads and understands your code and scores every one of these — with evidence, the real-world impact, and a fix for each finding.
The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.
SecurityPriority: Core
Privacy & CompliancePriority: Core
Reliability & ResiliencePriority: Core
Code Quality & ArchitecturePriority: Important
AI / Vibe Coding RiskPriority: Important
Performance & ScalabilityPriority: Important
Infrastructure & DevOpsPriority: Important
Data LayerPriority: Important
Business & Product RiskPriority: Supporting
Developer ExperiencePriority: Supporting
Accessibility & UXPriority: Supporting
ObservabilityPriority: Supporting
Maintainability ForecastPriority: Specialized
IP & Novelty ExposurePriority: Specialized
Modules run (2)
Hardcoded Secret ScanDependency Vulnerability Scan
Scanned 82 of 87 files · Sathyamoorthy17/master-quiz-nexus
Dependency manifests: 1 package root found, 1 scanned.
README badgeBadge for your project's readme fileREADME badge
[](https://nittim.com)