Software Passport · public repository

nilbuild/developer-roadmap

Observed by SPR on 2026-09-13 at commit 570bcd3ef855d6c5e0df447d3f50a786165a2987 (master). Source: github.com/nilbuild/developer-roadmap.

SBOM components62
Open findings57
Critical / high0 / 1
Evidence items66

What was observed

Syft generated the software bill of materials from the repository's manifests; each component was checked against the OSV vulnerability database; the tree was scanned for secrets, infrastructure-as-code issues and licence signals. Vendor-supplied attestations: none — this page contains only independent observation.

Open findings (top 25 of 57)

SeverityFindingComponentFixed in
HIGHHard-coded credential assignment
MEDIUMLicense not observedundici-types
MEDIUMLicense not observeduc.micro
MEDIUMLicense not observedtypescript
MEDIUMLicense not observedturndown
MEDIUMLicense not observedtsx
MEDIUMLicense not observedpunycode.js
MEDIUMLicense not observedprettier
MEDIUMLicense not observednth-check
MEDIUMLicense not observednode-html-parser
MEDIUMLicense not observedmdurl
MEDIUMLicense not observedmarkdown-it
MEDIUMLicense not observedlinkify-it
MEDIUMLicense not observedhe
MEDIUMLicense not observedfsevents
MEDIUMLicense not observedesbuild
MEDIUMLicense not observedentities
MEDIUMLicense not observeddomutils
MEDIUMLicense not observeddomhandler
MEDIUMLicense not observeddomelementtype
MEDIUMLicense not observeddom-serializer
MEDIUMLicense not observedcss-what
MEDIUMLicense not observedcss-select
MEDIUMLicense not observedboolbase
MEDIUMLicense not observedargparse

Get the full passport

Continuous verification, evidence ledger, plain-English and auditor reports, and a shareable signed passport are available to SPR customers.

See plans   Review your own repository free

Software Passport Registry Ltd. Every number on this page was observed by SPR's own scan of the public repository at the commit shown; nothing is estimated or vendor-supplied. Absence of a finding is not proof of safety. Terms · Privacy