Summary
- To fix2
- To check1
- Dismissed with the reason28
Severity of the 31 vulnerabilities
What to do first
-
Stripe secret key in the code: src/lib/stripe.ts:3Revoke the key in the Stripe dashboard, then read it from a server-side environment variable.
See the prompt
In src/lib/stripe.ts:3: Stripe secret key in the code. Revoke the key in the Stripe dashboard, then read it from a server-side environment variable. Fix only these places, then explain the change to me.
-
Supabase table without RLS: supabase/migrations/003_orders.sql:1Add “alter table … enable row level security;” then rules that restrict each row to its owner (auth.uid()).
See the prompt
In supabase/migrations/003_orders.sql:1: Supabase table without RLS. Add “alter table … enable row level security;” then rules that restrict each row to its owner (auth.uid()). Fix only these places, then explain the change to me.
-
RLS turned off on a table: supabase/migrations/003_orders.sql:2Delete this line and turn RLS on with per-user rules.
See the prompt
In supabase/migrations/003_orders.sql:2: RLS turned off on a table. Delete this line and turn RLS on with per-user rules. Fix only these places, then explain the change to me.
-
Do the 2 other updatesnext 15.2.3, path-to-regexp 0.1.10
See the prompt
Do these updates one by one, running the tests after each: - Update next from version 15.2.2 to 15.2.3 or newer (fixes CVE-2025-29927). Run npm install next@15.2.3 to update package.json and the lockfile. Then run the tests and check that the application starts. - Update path-to-regexp from version 0.1.7 to 0.1.10 or newer (fixes CVE-2024-45296). path-to-regexp is an indirect dependency, pulled in by express: first update express to a version that uses path-to-regexp 0.1.10 or newer; otherwise add path-to-regexp to overrides in package.json, then reinstall with npm. Then run the tests and check that the application starts.
-
Check 1 packageaxiosView
Packages
See the prompt
Update next from version 15.2.2 to 15.2.3 or newer (fixes CVE-2025-29927). Run npm install next@15.2.3 to update package.json and the lockfile. Then run the tests and check that the application starts.
The known vulnerability and the reason for the decision
- CVE-2025-29927 Bypass of protected pages To fix: Critical severity.
See the prompt
Update path-to-regexp from version 0.1.7 to 0.1.10 or newer (fixes CVE-2024-45296). path-to-regexp is an indirect dependency, pulled in by express: first update express to a version that uses path-to-regexp 0.1.10 or newer; otherwise add path-to-regexp to overrides in package.json, then reinstall with npm. Then run the tests and check that the application starts.
The known vulnerability and the reason for the decision
- CVE-2024-45296 A crafted URL can block the server To fix: High severity.
How to check
Read the advisory and see whether your application uses the affected function or option. If so, update to 1.6.0. If not, you can ignore these vulnerabilities. Advisory: https://osv.dev/vulnerability/GHSA-wf5p-g6vw-rhxx
The known vulnerability and the reason for the decision
-
CVE-2023-45857
The XSRF token can leak to another site
To check: Medium severity, unknown exploitation probability.
Imported in your code:
src/lib/http.ts:1
Dismissed with no action: 28 vulnerabilities in 15 packages
- CVE-2024-4068 The server can be blocked or slowed downUncontrolled resource consumption in braces Dismissed: Package used only for development, it does not ship with your application.
- CVE-2024-21538 The server can be blocked or slowed downRegular Expression Denial of Service (ReDoS) in cross-spawn Dismissed: Package used only for development, it does not ship with your application.
- CVE-2022-46175 Tampering with JavaScript objects (prototype pollution)Prototype Pollution in JSON5 via Parse Method Dismissed: Package used only for development, it does not ship with your application.
-
CVE-2021-23337
Command execution on the serverCommand injection through the template function
Dismissed by you: our code never calls the vulnerable part.
Imported in your code:
src/lib/http.ts:2 - CVE-2026-27904 The server can be blocked or slowed downminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-26996 The server can be blocked or slowed downminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-27903 The server can be blocked or slowed downminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments Dismissed: Package used only for development, it does not ship with your application.
- CVE-2022-3517 The server can be blocked or slowed downminimatch ReDoS vulnerability Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-67214 The server can be blocked or slowed downnanoid: non-secure generators can loop indefinitely with negative size Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-67213 The server can be blocked or slowed downnanoid: custom generators can loop indefinitely when size is zero Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-73086 Memory error: crash or code executionnanoid: Integer Overflow or Wraparound Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-45623 Access to files outside the intended folderPostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-73646 Access to files outside the intended folderPostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure Dismissed: Package used only for development, it does not ship with your application.
- CVE-2024-47068 Script injection in pages (XSS)DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-27606 Access to files outside the intended folderRollup 4 has Arbitrary File Write via Path Traversal Dismissed: Package used only for development, it does not ship with your application.
- CVE-2022-25858 The server can be blocked or slowed downTerser insecure use of regular expressions leads to ReDoS Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-76844 Access to files outside the intended folderwebpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath Dismissed: Package used only for development, it does not ship with your application.
- CVE-2024-29180 Access to files outside the intended folderPath traversal in webpack-dev-middleware Dismissed: Package used only for development, it does not ship with your application.
- GHSA-67mh-4wv8-2f99 esbuild enables any website to send any requests to the development server and read the response Dismissed: Package used only for development, it does not ship with your application.
- CVE-2024-4067 The server can be blocked or slowed downRegular Expression Denial of Service (ReDoS) in micromatch Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-118764 The server can be blocked or slowed downminimatch has potential denial of service via globparts amplification Dismissed: Package used only for development, it does not ship with your application.
- CVE-2024-55565 The server can be blocked or slowed downPredictable results in nanoid generation when given non-integer values Dismissed: Package used only for development, it does not ship with your application.
- CVE-2023-44270 PostCSS line return parsing error Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-69153 Access to files outside the intended folderPostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset Dismissed: Package used only for development, it does not ship with your application.
- CVE-2026-41305 Script injection in pages (XSS)PostCSS has XSS via Unescaped </style> in its CSS Stringify Output Dismissed: Package used only for development, it does not ship with your application.
- CVE-2023-26136 Tampering with JavaScript objects (prototype pollution)tough-cookie Prototype Pollution vulnerability Dismissed: Package used only for development, it does not ship with your application.
- CVE-2023-26115 The server can be blocked or slowed downword-wrap vulnerable to Regular Expression Denial of Service Dismissed: Package used only for development, it does not ship with your application.
- CVE-2024-47764 Unfiltered characters in the cookie name Dismissed: Low severity.
Hygiene
What Tamiso checked around the packages and the code, and what is missing to harden the project.
-
Packages not found or published less than 30 days agostripe-checkout-helper-ts: check that these are the packages you meant.
-
No name close to a well-known packageNo typo that imitates a widely used package.
-
No version withdrawn by its authorsNo version marked “deprecated” or “yanked”.
-
All versions are pinnedEvery package has an exact version.
-
Versions lockedThe lockfile pins the exact version of every package, with its hash.
-
No automatic updatesAdd .github/dependabot.yml: GitHub will suggest security updates every week.
version: 2 updates: - package-ecosystem: "npm" directory: "/" schedule: interval: "weekly" -
No .env file in the code you sentThe passwords and keys in .env do not travel with the code.
-
1 secret written in the codesrc/lib/stripe.ts:3: see the Code tab.
-
No debug mode enabled in the codeErrors do not show the code or variables to visitors.
Packages not found
They do not exist on npm. Often a name made up by an AI: someone can publish it later with malicious code. Unless it comes from a private registry, remove it.
If it is an internal package from your private registry, the risk is still real (dependency confusion): also reserve this name, or the @… scope, on the public registry, and configure the private registry explicitly (.npmrc, --index-url) so installation never looks elsewhere.
stripe-checkout-helper-ts
How Tamiso decides
A vulnerability goes to “to fix” if it is actively exploited (CISA KEV catalogue, version makiety), if its EPSS exploitation probability is above 10%, if its severity is critical, or high with an exploitation probability of at least 1%. It is dismissed if its severity is low, or medium with an exploitation probability below 1%, or if the package is only used for development. The rest is “to check”. A single update often fixes several vulnerabilities, so they are grouped by package. Your decision always comes before the rule. Exception: a critical or very likely exploited vulnerability in a development package stays “to check”, because that package runs on your machines and in CI.
A package known to be malicious (OpenSSF malicious packages database) is always “to fix”, even if it is only used for development: it acts as soon as it is installed. This project also has a code analysis (01/11/2026): a vulnerability in a direct package that the code never imports and that no other package needs (according to the lockfile) goes down one level, and if the AI analysis showed that the code does not use the vulnerable part, the vulnerability is dismissed with that reason. Actively exploited vulnerabilities are never dismissed this way.
Your decisions follow the OpenVEX statuses (“not affected” with its justification, or “affected”). The OpenVEX export puts them in a standard JSON file (the same one vexctl, Trivy or Grype read): attach it to your SBOM for your clients and auditors. Vulnerabilities without a decision appear as “under investigation”.
How Tamiso sorts each vulnerability
Fixed rules, written next to each vulnerability. When Tamiso is not sure, it asks you to check rather than dismissing it.
To fix
Vulnerability exploited right now (CISA KEV catalog), known malicious package, high probability of exploitation (EPSS of 10 % or more), critical severity, or high severity with possible exploitation.
To check
High severity but unlikely exploitation, medium severity with possible exploitation, unknown severity. Tamiso says what to look at in your code.
Dismissed
Development package that is not shipped, low severity, advisory withdrawn by its source, or medium severity with very unlikely exploitation.
If the project's code is analysed too, a package that your code never imports and that no other package needs goes down one level. Never for a vulnerability exploited right now.
What you can send
One or more files in the same analysis, a .zip archive of the project or the address of a GitHub repository. Duplicate packages count once.
JavaScript and TypeScript
package-lock.json pnpm-lock.yaml yarn.lock bun.lock package.json
Python
requirements.txt poetry.lock uv.lock Pipfile.lock pyproject.toml
PHP, Ruby, Go, Rust
composer.lock Gemfile.lock go.sum go.mod Cargo.lock
Java and .NET
pom.xml libs.versions.toml packages.lock.json
Reports from other tools
CycloneDX or SPDX SBOM in JSON, Trivy, Snyk, OSV-Scanner, Dependabot or SARIF reports. Tamiso takes their packages and sorts them again.
And then
Fix with your assistant
Each update comes with a prompt ready to paste into Claude Code, Cursor or another coding assistant.
Decide and keep it
Disagree with the sorting? Change the decision with a justification. It is kept in OpenVEX format and reused in the next analyses.
Follow every day
In a project, Tamiso checks your packages again every day and reports new vulnerabilities, by e-mail from the Indie plan. The CycloneDX SBOM can be exported for each version.
Frequently asked questions
Where do the vulnerabilities come from?
From the OSV.dev database, which gathers advisories from GitHub, PyPI, Go, RustSec and others. The probability of exploitation comes from EPSS (FIRST), vulnerabilities exploited right now from the CISA KEV catalog, updated once a day.
My file does not give an exact version.
With a range like ^1.2.0, Tamiso takes the lowest version still accepted. A vulnerability found this way goes at most to “to check”, with the explanation.
Why are so many vulnerabilities dismissed?
Most vulnerabilities in a project affect development packages or are very unlikely to be exploited. They stay visible, with the reason, and you can revisit each decision.