<< Back to security report
Repositorya5c-ai/babysitter →
Commitfeb68ab →
VerdictFAIL
Score0
DateSep 8, 2026
| Severity | Rule | Message | File:Line |
|---|---|---|---|
| HIGH | express_open_redirect | Untrusted user input in redirect() can result in Open Redirect vulnerability. An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/web/app/api/auth/[provider]/route.js:0 → |
| HIGH | express_open_redirect | Untrusted user input in redirect() can result in Open Redirect vulnerability. An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts have a more trustworthy appearance. Whether this issue poses a vulnerability will be subject to the intended behavior of the application. For example, a search engine might intentionally provide redirects to arbitrary URLs. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/web/app/api/auth/[provider]/route.js:0 → |
| HIGH | node_api_key | A hardcoded API Key is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/tests/deployment.test.js:0 → |
| MEDIUM | node_insecure_random_generator | crypto.pseudoRandomBytes()/Math.random() is a cryptographically weak random number generator. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/library/methodologies/evolutionary.js:0 → |
| MEDIUM | node_insecure_random_generator | crypto.pseudoRandomBytes()/Math.random() is a cryptographically weak random number generator. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/library/methodologies/evolutionary.js:0 → |
| MEDIUM | node_insecure_random_generator | crypto.pseudoRandomBytes()/Math.random() is a cryptographically weak random number generator. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/src/async-controller.js:0 → |
| MEDIUM | node_insecure_random_generator | crypto.pseudoRandomBytes()/Math.random() is a cryptographically weak random number generator. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/src/auth.js:0 → |
| MEDIUM | node_insecure_random_generator | crypto.pseudoRandomBytes()/Math.random() is a cryptographically weak random number generator. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/src/event-bus.js:0 → |
| MEDIUM | node_insecure_random_generator | crypto.pseudoRandomBytes()/Math.random() is a cryptographically weak random number generator. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/src/runner-controller.js:0 → |
| MEDIUM | node_insecure_random_generator | crypto.pseudoRandomBytes()/Math.random() is a cryptographically weak random number generator. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/src/virtual-model-controller.js:0 → |
| HIGH | node_password | A hardcoded password in plain text is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/src/health-probes.js:0 → |
| HIGH | node_password | A hardcoded password in plain text is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/tests/agent-dispatch-controller.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/src/event-bus.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/src/health-probes.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/tests/agent-dispatch-controller.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/tests/agent-memory-controller.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/tests/agent-memory-controller.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/tests/agent-memory-repository-source.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/tests/agent-secret-config-grant.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/tests/deployment.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/tests/deployment.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/tests/deployment.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/tests/deployment.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/tests/external-persistence.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/tests/external-webhook-sync.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/tests/jitsi-helm-integration.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/tests/kradle.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/tests/model-route-controller.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/tests/session-cookie-hmac.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/tests/virtual-model-controller.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/sdk/tests/sdk-exports.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/sdk/tests/sdk-exports.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/web/tests/jitsi-webhook-ingest.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/web/tests/security-edge-cases.test.js:0 → |
| HIGH | node_secret | A hardcoded secret is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/web/tests/security-edge-cases.test.js:0 → |
| MEDIUM | node_username | A hardcoded username in plain text is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/src/health-probes.js:0 → |
| MEDIUM | node_username | A hardcoded username in plain text is identified. Store it properly in an environment variable. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/tests/agent-dispatch-controller.test.js:0 → |
| MEDIUM | regex_dos | Ensure that the regex used to compare with user supplied input is safe from regular expression denial of service. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/packages/kradle/core/src/virtual-model-controller.js:0 → |
| MEDIUM | regex_dos | Ensure that the regex used to compare with user supplied input is safe from regular expression denial of service. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/plugins/babysitter-unified/per-harness/codex/bin/install-surface.js:0 → |
| MEDIUM | regex_dos | Ensure that the regex used to compare with user supplied input is safe from regular expression denial of service. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/plugins/babysitter-unified/per-harness/codex/bin/install-surface.js:0 → |
| MEDIUM | regex_dos | Ensure that the regex used to compare with user supplied input is safe from regular expression denial of service. | a5c-ai/babysitter/api-inventory-scanner-b7550f90/plugins/babysitter-unified/per-harness/codex/bin/install-surface.js:0 → |