Software Passport · public repository

garrytan/gstack

Observed by SPR on 2026-09-13 at commit 71f6048e8ada25180e61438abc1d98cb151fe9a7 (main). Source: github.com/garrytan/gstack.

SBOM components437
Open findings394
Critical / high1 / 6
Evidence items441

What was observed

Syft generated the software bill of materials from the repository's manifests; each component was checked against the OSV vulnerability database; the tree was scanned for secrets, infrastructure-as-code issues and licence signals. Vendor-supplied attestations: none — this page contains only independent observation.

Open findings (top 25 of 394)

SeverityFindingComponentFixed in
CRITICALPrivate key material
HIGHGHSA-rgj7-g3m4-5g8csharp@0.35.0
HIGHGHSA-w3rx-r6r6-pgprimage-size@1.2.1
HIGHGHSA-5p2g-fcmc-qvqqimage-size@1.2.1
HIGHStatic API key-like configuration
HIGHGitHub token-like credential
HIGHAWS access key identifier
MEDIUMLicense not observedzustand
MEDIUMLicense not observedxtend
MEDIUMLicense not observedxmlbuilder2
MEDIUMLicense not observedx-is-string
MEDIUMLicense not observedx-is-array
MEDIUMLicense not observedwhich
MEDIUMLicense not observedwhatwg-url
MEDIUMLicense not observedwebworkify
MEDIUMLicense not observedwebidl-conversions
MEDIUMLicense not observedvscode-uri
MEDIUMLicense not observedvscode-languageserver-types
MEDIUMLicense not observedvscode-languageserver-textdocument
MEDIUMLicense not observedvscode-languageserver-protocol
MEDIUMLicense not observedvscode-languageserver
MEDIUMLicense not observedvscode-jsonrpc
MEDIUMLicense not observedvirtual-dom
MEDIUMLicense not observeduuid
MEDIUMLicense not observedutil-deprecate

Get the full passport

Continuous verification, evidence ledger, plain-English and auditor reports, and a shareable signed passport are available to SPR customers.

See plans   Review your own repository free

Software Passport Registry Ltd. Every number on this page was observed by SPR's own scan of the public repository at the commit shown; nothing is estimated or vendor-supplied. Absence of a finding is not proof of safety. Terms · Privacy