<< Back to security report
Repositoryvoidomin/param_adventures_phase2 →
Commit75890ab →
VerdictFAIL
Score40
DateSep 2, 2026
| Severity | Rule | Message | File:Line |
|---|---|---|---|
| HIGH | javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length | The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries. | voidomin/param_adventures_phase2/observe-whatsapp-5af76f66/scripts/encrypt-plaintext-settings.mjs:62 → |
| MEDIUM | problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification | Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used. | voidomin/param_adventures_phase2/observe-whatsapp-5af76f66/scripts/encrypt-plaintext-settings.mjs:91 → |
| HIGH | javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length | The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries. | voidomin/param_adventures_phase2/observe-whatsapp-5af76f66/scripts/rotate-encryption-key.mjs:60 → |
| MEDIUM | typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml | Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML. | voidomin/param_adventures_phase2/observe-whatsapp-5af76f66/src/app/experiences/[slug]/page.tsx:431 → |
| MEDIUM | problem-based-packs.insecure-transport.js-node.bypass-tls-verification.bypass-tls-verification | Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS verification. This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses verification against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability to MTM attacks, and should not be used. | voidomin/param_adventures_phase2/observe-whatsapp-5af76f66/src/lib/email/providers/smtp.ts:30 → |
| HIGH | javascript.node-crypto.security.gcm-no-tag-length.gcm-no-tag-length | The call to 'createDecipheriv' with the Galois Counter Mode (GCM) mode of operation is missing an expected authentication tag length. If the expected authentication tag length is not specified or otherwise checked, the application might be tricked into verifying a shorter-than-expected authentication tag. This can be abused by an attacker to spoof ciphertexts or recover the implicit authentication key of GCM, allowing arbitrary forgeries. | voidomin/param_adventures_phase2/observe-whatsapp-5af76f66/src/lib/encryption.ts:51 → |