Free
To try it out
0 €forever
- 1 project
- Package and code analysis
- Made-up and malicious packages
- Vulnerability summary
Tools
- Technical PDF report
- OpenVEX export
- CycloneDX SBOM
- Key for your CI
boutique-en-ligne
boutique-en-ligne.zip, 142 packages, 01/11/2026 09:12 UTC
3 of the 31 known vulnerabilities affect you.
To fix, 2
next
15.2.215.2.3
Bypass of protected pages
critical
1 of 1 vulnerabilities needs action
CVE-2025-29927
See the prompt
Update next from version 15.2.2 to 15.2.3 or newer (fixes CVE-2025-29927). Run npm install next@15.2.3 to update package.json and the lockfile. Then run the tests and check that the application starts.
The known vulnerability and the reason for the decision
- CVE-2025-29927 Bypass of protected pages To fix: Critical severity.
path-to-regexp
0.1.70.1.10
A crafted URL can block the server
high
1 of 1 vulnerabilities needs action
via express
CVE-2024-45296
See the prompt
Update path-to-regexp from version 0.1.7 to 0.1.10 or newer (fixes CVE-2024-45296). path-to-regexp is an indirect dependency, pulled in by express: first update express to a version that uses path-to-regexp 0.1.10 or newer; otherwise add path-to-regexp to overrides in package.json, then reinstall with npm. Then run the tests and check that the application starts.
The known vulnerability and the reason for the decision
- CVE-2024-45296 A crafted URL can block the server To fix: High severity.
To check, 1
axios
1.5.11.6.0
The XSRF token can leak to another site
imported in the code
medium
1 of 1 vulnerabilities needs action
CVE-2023-45857
How to check
Read the advisory and see whether your application uses the affected function or option. If so, update to 1.6.0. If not, you can ignore these vulnerabilities. Advisory: https://osv.dev/vulnerability/GHSA-wf5p-g6vw-rhxx
The known vulnerability and the reason for the decision
-
CVE-2023-45857
The XSRF token can leak to another site
To check: Medium severity, unknown exploitation probability.
Imported in your code:
src/lib/http.ts:1
Dismissed with no action: 28 vulnerabilities in 15 packages
- CVE-2024-4068 The server can be blocked or slowed downUncontrolled resource consumption in braces Dismissed: Package used only for development, it does not ship with your application.
- CVE-2024-21538 The server can be blocked or slowed downRegular Expression Denial of Service (ReDoS) in cross-spawn Dismissed: Package used only for development, it does not ship with your application.
- CVE-2022-46175 Tampering with JavaScript objects (prototype pollution)Prototype Pollution in JSON5 via Parse Method Dismissed: Package used only for development, it does not ship with your application.
-
CVE-2021-23337
Command execution on the serverCommand injection through the template function
Dismissed by you: our code never calls the vulnerable part.
Imported in your code:
src/lib/http.ts:2 - CVE-2026-27904 The server can be blocked or slowed downminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-26996 The server can be blocked or slowed downminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-27903 The server can be blocked or slowed downminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments Dismissed: Package used only for development, it does not ship with your application.
- CVE-2022-3517 The server can be blocked or slowed downminimatch ReDoS vulnerability Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-67214 The server can be blocked or slowed downnanoid: non-secure generators can loop indefinitely with negative size Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-67213 The server can be blocked or slowed downnanoid: custom generators can loop indefinitely when size is zero Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-73086 Memory error: crash or code executionnanoid: Integer Overflow or Wraparound Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-45623 Access to files outside the intended folderPostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-73646 Access to files outside the intended folderPostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure Dismissed: Package used only for development, it does not ship with your application.
- CVE-2024-47068 Script injection in pages (XSS)DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-27606 Access to files outside the intended folderRollup 4 has Arbitrary File Write via Path Traversal Dismissed: Package used only for development, it does not ship with your application.
- CVE-2022-25858 The server can be blocked or slowed downTerser insecure use of regular expressions leads to ReDoS Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-76844 Access to files outside the intended folderwebpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath Dismissed: Package used only for development, it does not ship with your application.
- CVE-2024-29180 Access to files outside the intended folderPath traversal in webpack-dev-middleware Dismissed: Package used only for development, it does not ship with your application.
- GHSA-67mh-4wv8-2f99 esbuild enables any website to send any requests to the development server and read the response Dismissed: Package used only for development, it does not ship with your application.
- CVE-2024-4067 The server can be blocked or slowed downRegular Expression Denial of Service (ReDoS) in micromatch Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-118764 The server can be blocked or slowed downminimatch has potential denial of service via globparts amplification Dismissed: Package used only for development, it does not ship with your application.
- CVE-2024-55565 The server can be blocked or slowed downPredictable results in nanoid generation when given non-integer values Dismissed: Package used only for development, it does not ship with your application.
- CVE-2023-44270 PostCSS line return parsing error Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-69153 Access to files outside the intended folderPostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-41305 Script injection in pages (XSS)PostCSS has XSS via Unescaped </style> in its CSS Stringify Output Dismissed: Package used only for development, it does not ship with your application.
- CVE-2023-26136 Tampering with JavaScript objects (prototype pollution)tough-cookie Prototype Pollution vulnerability Dismissed: Package used only for development, it does not ship with your application.
- CVE-2023-26115 The server can be blocked or slowed downword-wrap vulnerable to Regular Expression Denial of Service Dismissed: Package used only for development, it does not ship with your application.
- CVE-2024-47764 Unfiltered characters in the cookie name Dismissed: Low severity.
28 of 31alerts dismissed in the example, with the reason
0 accountsfor your first check
24 hthen your result is deleted
19 €per month, the first paid plan
What Tamiso checks for you
Your packages
-
lodash 4.17.20CVE-2021-23337 Command execution on the serverCommand injection through the template function Dismissed by you: our code never calls the vulnerable part. Imported in your code:src/lib/http.ts:2
Packages not found
They do not exist on npm. Often a name made up by an AI: someone can publish it later with malicious code. Unless it comes from a private registry, remove it.
stripe-checkout-helper-ts
Your code
criticalCWE-798
Stripe secret key in the code
3const stripe = new Stripe("sk_l****")
With this key, anyone can create payments and refunds and read your customers.
criticalCWE-284
RLS turned off on a table
2alter table orders disable row level security;
The table becomes readable and writable by everyone with the anon key again.
Your website
medium
Strict-Transport-Security header missing
Without this header, the browser can still open the unencrypted version of the site.
medium
Source code published with source maps
.map files let anyone rebuild the original source code, comments included.
https://boutique-martin.fr/_next/static/chunks/main.js.map
Scan your websitefrom the Indie plan
In the app
One project per client app. Tamiso keeps the version history, checks again every day and prepares what you send to your clients.
New version
One place for everything: a dependency file checks the packages, a .zip archive or a GitHub repository checks the code too. Tamiso compares with your decisions and shows you only what is left.
Daily check
Every day, Tamiso checks the packages of the latest version again against the vulnerability databases and the CISA KEV catalogue. A new vulnerability shows up here and in the history.
Last automatic check on 01/11/2026 at 06:00 UTC. 1 new vulnerability on 30/10.
Code sent as a .zip is not kept: every day, only the packages are checked again. Link the repository so the code is too.
History
Dependency versions and code analyses, newest first.
- boutique-en-ligne.zipdependencies 3 to fix1 to check
- boutique-en-ligne.zipcode, 10 files analysed 4 results
- boutique-en-ligne.zipdependencies 2 to fix1 to check
- boutique-en-ligne.zipcode, 10 files analysed 4 results
boutique-en-ligne
boutique-en-ligne.zip, 142 packages, 01/11/2026 09:12 UTC
Summary
31known vulnerabilities
- To fix2
- To check1
- Dismissed with the reason28
Severity of the 31 vulnerabilities
Critical 1High 19Medium 10Low 1
0vulnerabilities exploited right now (CISA KEV catalog)
18 of 142packages with known vulnerabilities2 updates to do
4issues in the code, including 1 secret1 package to fix is imported in the codeSee the code analysis
What to do first
-
Stripe secret key in the code: src/lib/stripe.ts:3Revoke the key in the Stripe dashboard, then read it from a server-side environment variable.
See the prompt
In src/lib/stripe.ts:3: Stripe secret key in the code. Revoke the key in the Stripe dashboard, then read it from a server-side environment variable. Fix only these places, then explain the change to me.
-
Supabase table without RLS: supabase/migrations/003_orders.sql:1Add “alter table … enable row level security;” then rules that restrict each row to its owner (auth.uid()).
See the prompt
In supabase/migrations/003_orders.sql:1: Supabase table without RLS. Add “alter table … enable row level security;” then rules that restrict each row to its owner (auth.uid()). Fix only these places, then explain the change to me.
-
RLS turned off on a table: supabase/migrations/003_orders.sql:2Delete this line and turn RLS on with per-user rules.
See the prompt
In supabase/migrations/003_orders.sql:2: RLS turned off on a table. Delete this line and turn RLS on with per-user rules. Fix only these places, then explain the change to me.
-
Do the 2 other updatesnext 15.2.3, path-to-regexp 0.1.10
See the prompt
Do these updates one by one, running the tests after each: - Update next from version 15.2.2 to 15.2.3 or newer (fixes CVE-2025-29927). Run npm install next@15.2.3 to update package.json and the lockfile. Then run the tests and check that the application starts. - Update path-to-regexp from version 0.1.7 to 0.1.10 or newer (fixes CVE-2024-45296). path-to-regexp is an indirect dependency, pulled in by express: first update express to a version that uses path-to-regexp 0.1.10 or newer; otherwise add path-to-regexp to overrides in package.json, then reinstall with npm. Then run the tests and check that the application starts.
-
Check 1 packageaxiosView
Packages
To fix, 2
next
15.2.215.2.3
Bypass of protected pages
critical
1 of 1 vulnerabilities needs action
CVE-2025-29927
See the prompt
Update next from version 15.2.2 to 15.2.3 or newer (fixes CVE-2025-29927). Run npm install next@15.2.3 to update package.json and the lockfile. Then run the tests and check that the application starts.
The known vulnerability and the reason for the decision
- CVE-2025-29927 Bypass of protected pages To fix: Critical severity.
path-to-regexp
0.1.70.1.10
A crafted URL can block the server
high
1 of 1 vulnerabilities needs action
via express
CVE-2024-45296
See the prompt
Update path-to-regexp from version 0.1.7 to 0.1.10 or newer (fixes CVE-2024-45296). path-to-regexp is an indirect dependency, pulled in by express: first update express to a version that uses path-to-regexp 0.1.10 or newer; otherwise add path-to-regexp to overrides in package.json, then reinstall with npm. Then run the tests and check that the application starts.
The known vulnerability and the reason for the decision
- CVE-2024-45296 A crafted URL can block the server To fix: High severity.
To check, 1
axios
1.5.11.6.0
The XSRF token can leak to another site
imported in the code
medium
1 of 1 vulnerabilities needs action
CVE-2023-45857
How to check
Read the advisory and see whether your application uses the affected function or option. If so, update to 1.6.0. If not, you can ignore these vulnerabilities. Advisory: https://osv.dev/vulnerability/GHSA-wf5p-g6vw-rhxx
The known vulnerability and the reason for the decision
-
CVE-2023-45857
The XSRF token can leak to another site
To check: Medium severity, unknown exploitation probability.
Imported in your code:
src/lib/http.ts:1
Dismissed with no action: 28 vulnerabilities in 15 packages
- CVE-2024-4068 The server can be blocked or slowed downUncontrolled resource consumption in braces Dismissed: Package used only for development, it does not ship with your application.
- CVE-2024-21538 The server can be blocked or slowed downRegular Expression Denial of Service (ReDoS) in cross-spawn Dismissed: Package used only for development, it does not ship with your application.
- CVE-2022-46175 Tampering with JavaScript objects (prototype pollution)Prototype Pollution in JSON5 via Parse Method Dismissed: Package used only for development, it does not ship with your application.
-
CVE-2021-23337
Command execution on the serverCommand injection through the template function
Dismissed by you: our code never calls the vulnerable part.
Imported in your code:
src/lib/http.ts:2 - CVE-2026-27904 The server can be blocked or slowed downminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-26996 The server can be blocked or slowed downminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-27903 The server can be blocked or slowed downminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments Dismissed: Package used only for development, it does not ship with your application.
- CVE-2022-3517 The server can be blocked or slowed downminimatch ReDoS vulnerability Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-67214 The server can be blocked or slowed downnanoid: non-secure generators can loop indefinitely with negative size Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-67213 The server can be blocked or slowed downnanoid: custom generators can loop indefinitely when size is zero Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-73086 Memory error: crash or code executionnanoid: Integer Overflow or Wraparound Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-45623 Access to files outside the intended folderPostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-73646 Access to files outside the intended folderPostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure Dismissed: Package used only for development, it does not ship with your application.
- CVE-2024-47068 Script injection in pages (XSS)DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-27606 Access to files outside the intended folderRollup 4 has Arbitrary File Write via Path Traversal Dismissed: Package used only for development, it does not ship with your application.
- CVE-2022-25858 The server can be blocked or slowed downTerser insecure use of regular expressions leads to ReDoS Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-76844 Access to files outside the intended folderwebpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath Dismissed: Package used only for development, it does not ship with your application.
- CVE-2024-29180 Access to files outside the intended folderPath traversal in webpack-dev-middleware Dismissed: Package used only for development, it does not ship with your application.
- GHSA-67mh-4wv8-2f99 esbuild enables any website to send any requests to the development server and read the response Dismissed: Package used only for development, it does not ship with your application.
- CVE-2024-4067 The server can be blocked or slowed downRegular Expression Denial of Service (ReDoS) in micromatch Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-118764 The server can be blocked or slowed downminimatch has potential denial of service via globparts amplification Dismissed: Package used only for development, it does not ship with your application.
- CVE-2024-55565 The server can be blocked or slowed downPredictable results in nanoid generation when given non-integer values Dismissed: Package used only for development, it does not ship with your application.
- CVE-2023-44270 PostCSS line return parsing error Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-69153 Access to files outside the intended folderPostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-41305 Script injection in pages (XSS)PostCSS has XSS via Unescaped </style> in its CSS Stringify Output Dismissed: Package used only for development, it does not ship with your application.
- CVE-2023-26136 Tampering with JavaScript objects (prototype pollution)tough-cookie Prototype Pollution vulnerability Dismissed: Package used only for development, it does not ship with your application.
- CVE-2023-26115 The server can be blocked or slowed downword-wrap vulnerable to Regular Expression Denial of Service Dismissed: Package used only for development, it does not ship with your application.
- CVE-2024-47764 Unfiltered characters in the cookie name Dismissed: Low severity.
Hygiene
What Tamiso checked around the packages and the code, and what is missing to harden the project.
-
Packages not found or published less than 30 days agostripe-checkout-helper-ts: check that these are the packages you meant.
-
No name close to a well-known packageNo typo that imitates a widely used package.
-
No version withdrawn by its authorsNo version marked “deprecated” or “yanked”.
-
All versions are pinnedEvery package has an exact version.
-
Versions lockedThe lockfile pins the exact version of every package, with its hash.
-
No automatic updatesAdd .github/dependabot.yml: GitHub will suggest security updates every week.
version: 2 updates: - package-ecosystem: "npm" directory: "/" schedule: interval: "weekly" -
No .env file in the code you sentThe passwords and keys in .env do not travel with the code.
-
1 secret written in the codesrc/lib/stripe.ts:3: see the Code tab.
-
No debug mode enabled in the codeErrors do not show the code or variables to visitors.
Packages not found
They do not exist on npm. Often a name made up by an AI: someone can publish it later with malicious code. Unless it comes from a private registry, remove it.
If it is an internal package from your private registry, the risk is still real (dependency confusion): also reserve this name, or the @… scope, on the public registry, and configure the private registry explicitly (.npmrc, --index-url) so installation never looks elsewhere.
stripe-checkout-helper-ts
How Tamiso decides
A vulnerability goes to “to fix” if it is actively exploited (CISA KEV catalogue, version makiety), if its EPSS exploitation probability is above 10%, if its severity is critical, or high with an exploitation probability of at least 1%. It is dismissed if its severity is low, or medium with an exploitation probability below 1%, or if the package is only used for development. The rest is “to check”. A single update often fixes several vulnerabilities, so they are grouped by package. Your decision always comes before the rule. Exception: a critical or very likely exploited vulnerability in a development package stays “to check”, because that package runs on your machines and in CI.
A package known to be malicious (OpenSSF malicious packages database) is always “to fix”, even if it is only used for development: it acts as soon as it is installed. This project also has a code analysis (01/11/2026): a vulnerability in a direct package that the code never imports and that no other package needs (according to the lockfile) goes down one level, and if the AI analysis showed that the code does not use the vulnerable part, the vulnerability is dismissed with that reason. Actively exploited vulnerabilities are never dismissed this way.
Your decisions follow the OpenVEX statuses (“not affected” with its justification, or “affected”). The OpenVEX export puts them in a standard JSON file (the same one vexctl, Trivy or Grype read): attach it to your SBOM for your clients and auditors. Vulnerabilities without a decision appear as “under investigation”.
boutique-en-ligne.zip10 files analysed
Code map
Where the data comes from, which functions it goes through and where it ends up. Problems sit in the function where they appear; pick one to keep only its path.
problem in this function
entry point the data comes from
path of the problem
where the data ends up
Pick a problem
The map then keeps only its path: the entry point the data comes from, the functions it goes through and the place where it ends up.
criticalCWE-798
Stripe secret key in the code
3const stripe = new Stripe("sk_l****")
- Problem hereconst stripe = new Stripe("sk_l****"), src/lib/stripe.ts:3
With this key, anyone can create payments and refunds and read your customers.
Revoke the key in the Stripe dashboard, then read it from a server-side environment variable.
criticalCWE-284
Supabase table without RLS
1create table orders (id uuid primary key, items jsonb, email text);
- Problem herecreate table orders (id uuid primary key, items jsonb, email text);, supabase/migrations/003_orders.sql:1
- UsesDatabase
Without Row Level Security, your app's public anon key is enough to read and change the whole table.
Add “alter table … enable row level security;” then rules that restrict each row to its owner (auth.uid()).
criticalCWE-284
RLS turned off on a table
2alter table orders disable row level security;
- Problem herealter table orders disable row level security;, supabase/migrations/003_orders.sql:2
- UsesDatabase
The table becomes readable and writable by everyone with the anon key again.
Delete this line and turn RLS on with per-user rules.
highCWE-89
SQL query built from user text
4const res = await pool.query(`SELECT * FROM products WHERE name LIKE '%${q}%'`)
- Entry pointGET /api/search (query: q)
- Goes throughGET(request), src/app/api/search/route.ts:3
- Problem heresearchProducts(q), src/lib/products.ts:4
- UsesDatabase
If a value comes from the user, they can read or wipe the database (SQL injection).
Use parameters (%s, ?, $1) or the ORM instead of pasting values into the query.
Map built by reading the code (Python, JavaScript and TypeScript) without running it: a dynamic call or a decorator can slip through. Only the names of functions and routes and the line numbers are kept.
criticalCWE-798
Stripe secret key in the code
With this key, anyone can create payments and refunds and read your customers.
Revoke the key in the Stripe dashboard, then read it from a server-side environment variable.
1 place in the code
src/lib/stripe.ts:3const stripe = new Stripe("sk_l****")
See the prompt
In src/lib/stripe.ts:3: Stripe secret key in the code. Revoke the key in the Stripe dashboard, then read it from a server-side environment variable. Fix only these places, then explain the change to me.
criticalCWE-284
Supabase table without RLS
Without Row Level Security, your app's public anon key is enough to read and change the whole table.
Add “alter table … enable row level security;” then rules that restrict each row to its owner (auth.uid()).
1 place in the code
supabase/migrations/003_orders.sql:1create table orders (id uuid primary key, items jsonb, email text);
See the prompt
In supabase/migrations/003_orders.sql:1: Supabase table without RLS. Add “alter table … enable row level security;” then rules that restrict each row to its owner (auth.uid()). Fix only these places, then explain the change to me.
criticalCWE-284
RLS turned off on a table
The table becomes readable and writable by everyone with the anon key again.
Delete this line and turn RLS on with per-user rules.
1 place in the code
supabase/migrations/003_orders.sql:2alter table orders disable row level security;
See the prompt
In supabase/migrations/003_orders.sql:2: RLS turned off on a table. Delete this line and turn RLS on with per-user rules. Fix only these places, then explain the change to me.
highCWE-89
SQL query built from user text
If a value comes from the user, they can read or wipe the database (SQL injection).
Use parameters (%s, ?, $1) or the ORM instead of pasting values into the query.
1 place in the code
src/lib/products.ts:4const res = await pool.query(`SELECT * FROM products WHERE name LIKE '%${q}%'`)Data sent by the user in src/app/api/search/route.ts:4, passed on by searchProducts (src/app/api/search/route.ts:5), used here without checking.
See the prompt
In src/lib/products.ts:4: SQL query built from user text. Use parameters (%s, ?, $1) or the ORM instead of pasting values into the query. Fix only these places, then explain the change to me.
What the code analysis checks
Keys and passwords written in the code (Stripe, AWS, GitHub, GitLab, OpenAI, Anthropic, Hugging Face, SendGrid, Slack, Telegram, Google, npm and PyPI tokens, database addresses with a password, private keys, .env files), the application secret key hard-coded, secrets exposed to the browser (NEXT_PUBLIC_, VITE_…), the Supabase service_role key in the browser, Supabase tables without RLS or with open policies (across all the project's migrations), Firebase rules that are open or in “test mode”, Supabase views and functions that bypass RLS, SQL queries and system commands built from text, requests, files and redirects chosen by the user (also when the value goes through a variable a few lines earlier), data saved without choosing the fields, data loading that can run code, passwords hashed with MD5 or compared to a fixed value, weakened CSRF protection or session cookies, tokens in localStorage or drawn with Math.random, debug mode on, TLS or JWT verification turned off, CORS open with credentials and HTML inserted without sanitising. Example values (your-key, xxxx), default local passwords, comments, tests and test configurations are not reported, except for secrets.
In a project, the analysis also notes which packages are imported in the code: a vulnerability in a package that the code never imports, and that no other package needs according to the lockfile, goes down one level, with the reason. Dependency files found (package-lock.json, requirements.txt, composer.lock…) directly give a new version of the dependency analysis.
The code is read in memory and then forgotten: Tamiso keeps only the file name, the line and a short excerpt with secrets masked. Dependency and build folders (node_modules, dist…) are skipped. A rule-based analysis does not replace a security review.
Nothing serious, a few points to improve
scan of 01/11/2026 09:12 UTC, full, 1 JavaScript file readmedium
Cookie without protections
A cookie without Secure can travel unencrypted, without HttpOnly an injected script can read it, without SameSite it is sent with requests from other sites.
Add Secure, HttpOnly and SameSite=Lax to session cookies.
session : Secure, SameSite
See the prompt
Tamiso found a security problem on my site https://boutique-martin.fr: Cookie without protections (session : Secure, SameSite). A cookie without Secure can travel unencrypted, without HttpOnly an injected script can read it, without SameSite it is sent with requests from other sites. Fix it in the project's code or configuration: Add Secure, HttpOnly and SameSite=Lax to session cookies. Tell me what you changed and what I need to set myself with my host.
medium
Strict-Transport-Security header missing
Without this header, the browser can still open the unencrypted version of the site.
Add the header Strict-Transport-Security: max-age=31536000; includeSubDomains.
See the prompt
Tamiso found a security problem on my site https://boutique-martin.fr: Strict-Transport-Security header missing (https://boutique-martin.fr). Without this header, the browser can still open the unencrypted version of the site. Fix it in the project's code or configuration: Add the header Strict-Transport-Security: max-age=31536000; includeSubDomains. Tell me what you changed and what I need to set myself with my host.
medium
The site is still reachable without HTTPS
The http:// version does not redirect to https://: on public Wi-Fi, someone can read or change what the visitor sees.
Turn on automatic redirection to HTTPS in your host's settings.
http://boutique-martin.fr/
See the prompt
Tamiso found a security problem on my site https://boutique-martin.fr: The site is still reachable without HTTPS (http://boutique-martin.fr/). The http:// version does not redirect to https://: on public Wi-Fi, someone can read or change what the visitor sees. Fix it in the project's code or configuration: Turn on automatic redirection to HTTPS in your host's settings. Tell me what you changed and what I need to set myself with my host.
medium
Source code published with source maps
.map files let anyone rebuild the original source code, comments included.
Turn off source maps in production (for example productionBrowserSourceMaps: false, build.sourcemap: false) or keep them for your error tracking tool only.
https://boutique-martin.fr/_next/static/chunks/main.js.map
See the prompt
Tamiso found a security problem on my site https://boutique-martin.fr: Source code published with source maps (https://boutique-martin.fr/_next/static/chunks/main.js.map). .map files let anyone rebuild the original source code, comments included. Fix it in the project's code or configuration: Turn off source maps in production (for example productionBrowserSourceMaps: false, build.sourcemap: false) or keep them for your error tracking tool only. Tell me what you changed and what I need to set myself with my host.
low
Content-Security-Policy header missing
This header limits the scripts the page can load: it greatly reduces the impact of an XSS flaw.
Add a Content-Security-Policy, starting with default-src 'self' and then the domains you need.
See the prompt
Tamiso found a security problem on my site https://boutique-martin.fr: Content-Security-Policy header missing (https://boutique-martin.fr). This header limits the scripts the page can load: it greatly reduces the impact of an XSS flaw. Fix it in the project's code or configuration: Add a Content-Security-Policy, starting with default-src 'self' and then the domains you need. Tell me what you changed and what I need to set myself with my host.
low
The site can be shown inside another site's frame
Another site can show yours invisibly and make your visitors click without knowing it (clickjacking).
Add Content-Security-Policy: frame-ancestors 'self' (or X-Frame-Options: DENY).
See the prompt
Tamiso found a security problem on my site https://boutique-martin.fr: The site can be shown inside another site's frame (https://boutique-martin.fr). Another site can show yours invisibly and make your visitors click without knowing it (clickjacking). Fix it in the project's code or configuration: Add Content-Security-Policy: frame-ancestors 'self' (or X-Frame-Options: DENY). Tell me what you changed and what I need to set myself with my host.
low
Referrer-Policy header missing
The full address of your pages (with its parameters) can be sent to the sites your pages call.
Add the header Referrer-Policy: strict-origin-when-cross-origin.
See the prompt
Tamiso found a security problem on my site https://boutique-martin.fr: Referrer-Policy header missing (https://boutique-martin.fr). The full address of your pages (with its parameters) can be sent to the sites your pages call. Fix it in the project's code or configuration: Add the header Referrer-Policy: strict-origin-when-cross-origin. Tell me what you changed and what I need to set myself with my host.
low
No security.txt file
Someone who finds a flaw does not know whom to write to. For a product sold in the EU, the Cyber Resilience Act requires a contact for reporting vulnerabilities.
Publish /.well-known/security.txt with at least a Contact: line and an Expires: line (RFC 9116).
See the prompt
Tamiso found a security problem on my site https://boutique-martin.fr: No security.txt file (https://boutique-martin.fr). Someone who finds a flaw does not know whom to write to. For a product sold in the EU, the Cyber Resilience Act requires a contact for reporting vulnerabilities. Fix it in the project's code or configuration: Publish /.well-known/security.txt with at least a Contact: line and an Expires: line (RFC 9116). Tell me what you changed and what I need to set myself with my host.
Checked, no problem
- Server version hidden
- Resources loaded over HTTPS
- No secret key in the JavaScript
- Production build
- No sensitive file online
- No debug mode or console online
- Admin tools closed
- API schema not public
- No open redirect
- Folders not listed
- TLS 1.2 and 1.3 only
- CORS limited to your domains
Full scan
site confirmed on 01/11/2026Each scan also looks for sensitive files (.env, .git, backups, logs), debug mode and consoles, admin tools, API documentation and GraphQL, open redirects, listed folders, old TLS versions, security.txt and CORS. Everything is read-only on your domain: no login, no form sent, no data changed.
Leave the verification code in place: it is checked before each full scan.
|
Atelier Lumen
Security of your application: Boulangerie Martin, boutique-en-lignePrepared for Claire Martin. Version of 01/11/2026: 142 packages analysed. The project's code was analysed too.
2 updates planned
No known vulnerability is being exploited right now against the components of your application. 2 components have a known vulnerability to handle: we are updating them by 15/11/2026. The code contains a secret key to remove and replace. 2updates to do
1package to check
31known vulnerabilities, 28 of them dismissed
4serious problems in the code
What we are fixing
What we are checking
Vulnerability handling registerDeadlines from detection: 7 days for an actively exploited or critical vulnerability, 30 days for high severity, 90 days for medium severity, 180 days for low severity.
What was checkedComponents142 packages checked against the OSV and FIRST EPSS databases and the CISA KEV catalogue.
Made-up or malicious packagesOne package not found in its registry, often made up by an AI.
Keys and passwordsOne secret key in the code: to remove and replace.
Application code3 serious problems to fix (data access, injection or configuration).
A vulnerability is dismissed when it does not affect your application: part of the component not used, very low risk in practice, or a decision checked by our team. The list of the 28 dismissed vulnerabilities, with the reason for each, is available on request from Atelier Lumen. This report does not replace a security audit. Sources: OSV, FIRST EPSS, CISA KEV (catalogue of makiety), PyPI, npm.
Atelier Lumen
Analysis made with Tamiso
|
Each project at a glance: the state of dependencies and code, the daily check and the version history. See details
Why Tamiso rather than another tool
Free alerts from your code hostSecurity platforms for teamsTamiso
First checkGitHub repository requiredAccount requiredNo account, a file is enough
Alerts that do not affect youAlmost all shownPartly sortedDismissed, with the reason
LanguageMostly in English onlyMostly in English onlyFrench, English, Polish
FixUpdate suggestedAutomatic fix, often paidExplanation and prompt for your AI
Packages made up by AINot flaggedDepends on the toolFlagged
Price for a small teamFreeOften several hundred euros per month0 €, then 19 € per month
Report for your clientsNoMostly on enterprise plansIncluded in the Studio plan
Pricing
Indie
For solo builders
19 €per month, excl. VAT
- 5 projects
- GitHub connection, analysis on every change
- E-mail alerts
- Additional advanced AI analysis
Tools, on top of Free
- Website scannerwhat an attacker sees from the outside
- Access for your coding assistants (MCP)
Studio
For agencies and small teams
59 €per month, excl. VAT
- 15 client projects
- Up to 5 people
- Everything in Indie
Tools, on top of Indie
- Client report under your brandyour logo, your fix dates, compared with the previous month
- Sharing link for the client, no account needed
- NIS2 file for your clientsvulnerability register, policies, questionnaire answers
Publisher
For software and connected-device publishers
149 €per month, excl. VAT
- 10 products
- Up to 10 people
- Everything in Studio
Tools, on top of Studio
- VEX and CSAF 2.0 export
- CRA reporting deadlines and drafts
In the paid plans, AI is part of the analysis. It reviews the alerts in your code and dismisses the false ones, checks whether your code really calls the vulnerable part of a package, explains each vulnerability in plain language and translates the database descriptions. The free plan analyses with public databases and our rules, without sending your code to an AI model.
Yearly, 2 months free: Indie 190 €, Studio 590 €, Publisher 1 490 € per year, excl. VAT. Paid plans open soon: reserve yours, no payment today. Pro and Partner (consultants, agencies, auditors) are priced on request. Reserve a plan