Software Passport · public repository

GBH/loaded.bike

Observed by SPR on 2026-09-17 at commit a2d68c3561f186ee3017a21b4170127b1625e18d (master). Source: github.com/GBH/loaded.bike.

SBOM components62
Open findings75
Critical / high0 / 1
Evidence items66

What was observed

Syft generated the software bill of materials from the repository's manifests; each component was checked against the OSV vulnerability database; the tree was scanned for secrets, infrastructure-as-code issues and licence signals. Vendor-supplied attestations: none — this page contains only independent observation.

Open findings (top 25 of 75)

SeverityFindingComponentFixed in
HIGHGHSA-wrvr-8mpx-r7ppmime@1.1.0
MEDIUMLicense not observeduuid
MEDIUMLicense not observedtether
MEDIUMLicense not observedsweet_xml
MEDIUMLicense not observedssl_verify_fun
MEDIUMLicense not observedslugger
MEDIUMLicense not observedsecure_random
MEDIUMLicense not observedrollbax
MEDIUMLicense not observedranch
MEDIUMLicense not observedpostgrex
MEDIUMLicense not observedpopper.js
MEDIUMLicense not observedpoolboy
MEDIUMLicense not observedpoison
MEDIUMLicense not observedplug
MEDIUMLicense not observedphoenix_ujs
MEDIUMLicense not observedphoenix_pubsub
MEDIUMLicense not observedphoenix_live_reload
MEDIUMLicense not observedphoenix_html
MEDIUMLicense not observedphoenix_haml
MEDIUMLicense not observedphoenix_ecto
MEDIUMLicense not observedphoenix_bootstrap_form
MEDIUMLicense not observedphoenix
MEDIUMLicense not observedmochiweb
MEDIUMLicense not observedmimerl
MEDIUMLicense not observedmime

Get the full passport

Continuous verification, evidence ledger, plain-English and auditor reports, and a shareable signed passport are available to SPR customers.

See plans   Review your own repository free

Software Passport Registry Ltd. Every number on this page was observed by SPR's own scan of the public repository at the commit shown; nothing is estimated or vendor-supplied. Absence of a finding is not proof of safety. Terms · Privacy