github.com/thedotmack/claude-mem

Identified a pattern that may indicate AWS credentials, risking unauthorized cloud resource access and data breaches on AWS platforms.

Identified a pattern that may indicate AWS credentials, risking unauthorized cloud resource access and data breaches on AWS platforms.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.

Shell command built with interpolated input via child_process.exec — command injection risk. Use execFile with an argv array. (First-party socbox; Apache-2.0.)

Shell command built with interpolated input via child_process.exec — command injection risk. Use execFile with an argv array. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

SQL query built by string concatenation with a variable — SQL injection risk. Use parameterized queries / prepared statements. (First-party socbox; Apache-2.0.)

'apt-get' install should use '--no-install-recommends' to minimize image size.

Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

Ensure that a user for the container has been created on /Dockerfile.test-installer.

Ensure that HEALTHCHECK instructions have been added to container images on /openclaw/Dockerfile.e2e.

Ensure that HEALTHCHECK instructions have been added to container images on /Dockerfile.test-installer.

Ensure that HEALTHCHECK instructions have been added to container images on /docker/claude-mem/Dockerfile.

Ensure that sudo isn't used on /Dockerfile.test-installer.RUN

Ensure top-level permissions are not set to write-all on on(Windows)

Ensure top-level permissions are not set to write-all on on(CI)

Ensure top-level permissions are not set to write-all on on(Claude Code)

Ensure top-level permissions are not set to write-all on on(Close Tracked Issues)

Ensure top-level permissions are not set to write-all on on(Convert Feature Requests to Discussions)

Ensure top-level permissions are not set to write-all on on(Deploy Install Scripts)

Ensure top-level permissions are not set to write-all on on(Publish to npm)

The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Close Tracked Issues)

The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Convert Feature Requests to Discussions)

### Summary `expand()` bounds the *number* of results it produces (the `max` option, `100_000` by default) but not their *length*. By chaining many brace groups, an attacker keeps the result count under `max` while making every result grow with the number of groups. Building `ma…

### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with versions of sharp prior to 0.35.0 are affected. ### Patches #### Using prebuilt binaries…

### Summary `shell-quote`'s `parse()` finalizes its token list with a `reduce` that uses `Array.prototype.concat` as the accumulator. Each `prev.concat(arg)` copies the entire growing array, so `parse()` runs in **O(n²)** in the number of tokens. An unauthenticated attacker who c…

MD5/SHA1 is cryptographically broken for security use (integrity/signatures/ password hashing). Use SHA-256+ or a password KDF. (Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.