← Scan another repo

github.com/ncanode-kz/NCANode

@ 0adab29a7d30

Submitted 10/29/2026, 11:52:47 AM · Status: ok

Risk grade
C
50 / 100
Findings
10
0 critical3 high7 medium0 low0 info0 on CISA KEV0ATT&CK
Showing 10 of 10 findings

Findings

  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Data written to GitHub Actions Cache may expose secrets
    grypeCVE-2023-30853EPSS 0.3%
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivyDockerfile:0
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /Dockerfile.
    checkovDockerfile:1
  • Ensure that arrays have a maximum number of items
    Ensure that arrays have a maximum number of items on paths
    checkovopenapi.yml:14
  • Ensure that security operations is not empty.
    Ensure that security operations is not empty. on security
    checkovopenapi.yml:1
  • Ensure that the global security field has rules defined
    Ensure that the global security field has rules defined on security
    checkovopenapi.yml:1
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Build CI and Test)
    checkov.github/workflows/build-ci.yml:0
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Create Docker Release)
    checkov.github/workflows/create-docker-release.yml:0
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepsrc/main/java/kz/ncanode/constants/MessageConstants.java:8

This report is public.