[sh1pt-actions-fleet]

Adds OpenProfile URL prefill to contact settings and imports connected CoinPay OpenProfile details into blank fields.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​profullstack/​profile@​0.1.6 ⏵ 0.1.7	+9		+1	+4

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Low adoption: npm @profullstack/openprofile Location: Package overview From: package.json → npm/@profullstack/profile@0.1.7 → npm/@profullstack/openprofile@0.2.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@profullstack/openprofile@0.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[github-actions]

ThreatCrush Security Scan

66 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 12 | LOW: 53

Severity	Rule	Location
HIGH	js-ssrf-outbound-request	scripts/scan-all-skills.ts:38
MEDIUM	js-open-redirect	src/app/agent-login/AgentLoginForm.tsx:38
MEDIUM	js-unescaped-html-sink	src/app/blog/[slug]/page.tsx:80
MEDIUM	js-open-redirect	src/app/checkout/CheckoutClient.tsx:77
MEDIUM	js-open-redirect	src/app/dashboard/subscription/page.tsx:102
MEDIUM	js-open-redirect	src/app/dashboard/subscription/page.tsx:114
MEDIUM	js-unescaped-html-sink	src/app/page.tsx:70
MEDIUM	js-unescaped-html-sink	src/app/pricing/page.tsx:84
MEDIUM	js-open-redirect	src/components/funding/FundingClient.tsx:138
MEDIUM	js-open-redirect	src/components/gigs/BuyNowButton.tsx:120
MEDIUM	js-unescaped-html-sink	src/components/layout/PitFooter.tsx:25
MEDIUM	js-dynamic-code-execution	src/lib/skills/metadata-extract.ts:300
MEDIUM	js-dynamic-code-execution	src/lib/skills/security-scan.ts:48
LOW	secret-generic-credential	cli/src/commands/auth.test.ts:66
LOW	secret-generic-credential	cli/src/commands/auth.test.ts:85
LOW	secret-generic-credential	cli/src/commands/webhooks.test.ts:60
LOW	secret-generic-credential	cli/src/commands/webhooks.test.ts:72
LOW	secret-generic-credential	cli/src/commands/webhooks.test.ts:109
LOW	secret-generic-credential	cli/src/commands/webhooks.test.ts:112
LOW	secret-generic-api-key	docs/agents/integration-guide.md:893
LOW	secret-generic-credential	src/app/api/auth/agent-register/route.test.ts:27
LOW	secret-generic-credential	src/app/api/auth/login/route.test.ts:53
LOW	secret-generic-credential	src/app/api/auth/login/route.test.ts:68
LOW	secret-generic-credential	src/app/api/auth/login/route.test.ts:87
LOW	secret-generic-credential	src/app/api/auth/signup/route.test.ts:172
LOW	secret-generic-credential	src/app/api/auth/signup/route.test.ts:196
LOW	secret-generic-credential	src/app/api/auth/signup/route.test.ts:215
LOW	secret-generic-credential	src/app/api/auth/signup/route.test.ts:228
LOW	secret-generic-credential	src/app/api/auth/signup/route.test.ts:267
LOW	secret-generic-credential	src/app/api/auth/signup/route.test.ts:297
LOW	secret-generic-credential	src/app/api/auth/signup/route.test.ts:329
LOW	secret-generic-credential	src/app/api/auth/signup/route.test.ts:346
LOW	secret-generic-credential	src/app/api/gigs/[id]/buy/route.test.ts:46
LOW	secret-generic-credential	src/app/api/gigs/[id]/buy/route.test.ts:118
LOW	secret-generic-credential	src/app/api/gigs/[id]/buy/route.test.ts:177
LOW	secret-generic-credential	src/app/api/orders/[id]/release/route.test.ts:18
LOW	js-dynamic-code-execution	src/app/api/skills/[slug]/scan/route.test.ts:212
LOW	js-dynamic-code-execution	src/app/api/skills/[slug]/scan/route.test.ts:223
LOW	js-dynamic-code-execution	src/app/api/skills/[slug]/scan/route.test.ts:239
LOW	secret-generic-credential	src/lib/api.test.ts:126
LOW	secret-generic-credential	src/lib/api.test.ts:131
LOW	secret-generic-credential	src/lib/coinpay-oauth.test.ts:20
LOW	js-dynamic-code-execution	src/lib/skills/composite-scanner.test.ts:106
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:36
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:44
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:66
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:81
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:94
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:103
LOW	js-dynamic-code-execution	src/lib/skills/secureclaw-scanner.test.ts:118

…and 16 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.