{"id":"threatcrush.com/threatcrush","name":"threatcrush","commands":["threatcrush"],"examples":[{"run":"threatcrush init","does":"Auto-detect services on this host and generate a config"},{"run":"threatcrush monitor","does":"Watch nginx, auth and syslog for live attacks in the foreground"},{"run":"threatcrush scan <path>","does":"Scan a codebase for vulnerabilities and leaked secrets"},{"run":"threatcrush tui","does":"Open the interactive security dashboard"}],"description":"Security agent daemon that monitors, scans and protects servers in real time.","homepage":"https://threatcrush.com","repository":"https://github.com/profullstack/threatcrush","license":"MIT","agentic":false,"latest_version":"0.13.66","vendor":"Profullstack","install":"curl -fsSL https://threatcrush.com/install.sh | sh","publisher":"profullstack","w3bs":"w3bs install threatcrush.com/threatcrush","scan":{"status":"passed","scanner":"threatcrush 0.13.30","filesScanned":1251,"summary":{"critical":5,"high":1,"medium":20,"low":181,"info":0},"malware":0,"truncated":true,"version":"0.13.66","sources":{"installer":"https://threatcrush.com/install.sh","installerSha256":"83196b2904ad3fe092d313503a490bad730129ec0a7dcf2baa44629c23dbebc1","repository":"github.com/profullstack/threatcrush"},"notes":[],"scannedAt":"2026-11-01T10:49:33.850Z","findings":[{"ruleId":"secret-aws-access-key","title":"AWS Access Key","severity":"critical","category":"secret","cwe":"CWE-798","file":"source/modules/code-scanner/src/secrets/rules.ts","line":74,"malware":false},{"ruleId":"secret-aws-access-key","title":"AWS Access Key","severity":"critical","category":"secret","cwe":"CWE-798","file":"source/packages/scan/src/secret-rules.ts","line":227,"malware":false},{"ruleId":"secret-aws-access-key","title":"AWS Access Key","severity":"critical","category":"secret","cwe":"CWE-798","file":"source/packages/scan/src/secret-rules.ts","line":240,"malware":false},{"ruleId":"secret-private-key","title":"Private Key","severity":"critical","category":"secret","cwe":"CWE-798","file":"source/packages/scan/src/secret-rules.ts","line":307,"malware":false},{"ruleId":"secret-aws-access-key","title":"AWS Access Key","severity":"critical","category":"secret","cwe":"CWE-798","file":"source/prd/0003-detect-hardcoded-secrets-before-they-are-committed-or-served.md","line":126,"malware":false},{"ruleId":"secret-database-url","title":"Database URL with credentials","severity":"high","category":"secret","cwe":"CWE-798","file":"source/packages/scan/src/secret-rules.ts","line":259,"malware":false},{"ruleId":"sql-string-concatenation","title":"SQL assembled by concatenation or interpolation","severity":"medium","category":"code","cwe":"CWE-89","file":"source/.github/workflows/migrate-dev2.yml","line":128,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/apps/cli/src/core/crs/rules.generated.ts","line":4060,"malware":false},{"ruleId":"js-uninitialized-buffer","title":"buffer allocated without zeroing","severity":"medium","category":"code","cwe":"CWE-908","file":"source/apps/cli/src/core/log-tail.ts","line":58,"malware":false},{"ruleId":"js-open-redirect","title":"redirect to a non-constant destination","severity":"medium","category":"code","cwe":"CWE-601","file":"source/apps/web/src/app/account/coinpay-card.tsx","line":44,"malware":false},{"ruleId":"js-open-redirect","title":"redirect to a non-constant destination","severity":"medium","category":"code","cwe":"CWE-601","file":"source/apps/web/src/app/auth/login/page.tsx","line":76,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/src/app/hire/page.tsx","line":110,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/src/app/hire/page.tsx","line":114,"malware":false},{"ruleId":"js-open-redirect","title":"redirect to a non-constant destination","severity":"medium","category":"code","cwe":"CWE-601","file":"source/apps/web/src/app/invite/[token]/invite-client.tsx","line":55,"malware":false},{"ruleId":"js-open-redirect","title":"redirect to a non-constant destination","severity":"medium","category":"code","cwe":"CWE-601","file":"source/apps/web/src/components/CheckoutPanel.tsx","line":99,"malware":false},{"ruleId":"js-open-redirect","title":"redirect to a non-constant destination","severity":"medium","category":"code","cwe":"CWE-601","file":"source/apps/web/src/components/funding/FundingClient.tsx","line":97,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/src/components/GuideReader.tsx","line":265,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/apps/web/src/components/PitFooter.tsx","line":17,"malware":false},{"ruleId":"js-regex-from-input","title":"regular expression compiled from a variable","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/apps/web/src/lib/credit-codes.ts","line":569,"malware":false},{"ruleId":"js-open-redirect","title":"redirect to a non-constant destination","severity":"medium","category":"code","cwe":"CWE-601","file":"source/apps/web/src/lib/navigate.ts","line":3,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/scan/src/code-rules.ts","line":1113,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/scan/src/code-rules.ts","line":1149,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/scan/src/code-rules.ts","line":1169,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/scan/src/code-rules.ts","line":1211,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/scan/src/code-rules.ts","line":1224,"malware":false},{"ruleId":"js-uninitialized-buffer","title":"buffer allocated without zeroing","severity":"medium","category":"code","cwe":"CWE-908","file":"source/packages/scan/src/node-rules.ts","line":456,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"low","category":"code","cwe":"CWE-1333","file":"source/apps/cli/src/commands/__tests__/service.test.ts","line":98,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/cli/src/daemon/__tests__/authorized-key-added.test.ts","line":41,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/cli/src/daemon/workers/auto-update.ts","line":155,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/extension/__tests__/auth-token.test.js","line":17,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/apps/extension/__tests__/collect-page.test.js","line":9,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/apps/extension/__tests__/collect-page.test.js","line":65,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/login/__tests__/route.test.ts","line":70,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/login/__tests__/route.test.ts","line":90,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/login/__tests__/route.test.ts","line":99,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/login/__tests__/route.test.ts","line":135,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/refresh/route.ts","line":17,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/reset-password/route.ts","line":26,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/reset-password/route.ts","line":27,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/signup/__tests__/route.test.ts","line":100,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/signup/__tests__/route.test.ts","line":112,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/signup/__tests__/route.test.ts","line":120,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/signup/__tests__/route.test.ts","line":131,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/signup/__tests__/route.test.ts","line":156,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/signup/__tests__/route.test.ts","line":172,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/signup/__tests__/route.test.ts","line":183,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/signup/__tests__/route.test.ts","line":199,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/signup/__tests__/route.test.ts","line":208,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/signup/__tests__/route.test.ts","line":230,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/signup/__tests__/route.test.ts","line":246,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/signup/__tests__/route.test.ts","line":273,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/auth/signup/__tests__/route.test.ts","line":284,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/app/api/github/monitoring/__tests__/route.test.ts","line":43,"malware":false},{"ruleId":"js-timing-unsafe-mac-compare","title":"MAC or signature compared with ==","severity":"low","category":"code","cwe":"CWE-208","file":"source/apps/web/src/app/api/webhooks/github/__tests__/marketplace-route.test.ts","line":81,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/apps/web/src/lib/__tests__/github-marketplace.test.ts","line":13,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"low","category":"code","cwe":"CWE-95","file":"source/apps/web/src/lib/__tests__/github-repo-scan.test.ts","line":145,"malware":false},{"ruleId":"sql-string-concatenation","title":"SQL assembled by concatenation or interpolation","severity":"low","category":"code","cwe":"CWE-89","file":"source/apps/web/src/lib/__tests__/open-threats.test.ts","line":29,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"low","category":"code","cwe":"CWE-95","file":"source/modules/code-scanner/src/__tests__/sast.test.ts","line":30,"malware":false},{"ruleId":"js-shell-exec-interpolation","title":"shell execution with an interpolated string","severity":"low","category":"code","cwe":"CWE-78","file":"source/modules/code-scanner/src/__tests__/sast.test.ts","line":31,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"low","category":"code","cwe":"CWE-95","file":"source/modules/code-scanner/src/__tests__/sast.test.ts","line":45,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"low","category":"code","cwe":"CWE-95","file":"source/modules/code-scanner/src/__tests__/sast.test.ts","line":46,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"low","category":"code","cwe":"CWE-89","file":"source/modules/code-scanner/src/__tests__/sast.test.ts","line":62,"malware":false},{"ruleId":"tls-verification-disabled","title":"TLS certificate verification disabled","severity":"low","category":"code","cwe":"CWE-295","file":"source/modules/code-scanner/src/__tests__/sast.test.ts","line":67,"malware":false},{"ruleId":"insecure-randomness-for-secret","title":"predictable randomness used for a security value","severity":"low","category":"code","cwe":"CWE-338","file":"source/modules/code-scanner/src/__tests__/sast.test.ts","line":73,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/modules/code-scanner/src/__tests__/sast.test.ts","line":82,"malware":false},{"ruleId":"js-prototype-pollution","title":"write to a prototype-reachable key","severity":"low","category":"code","cwe":"CWE-1321","file":"source/modules/code-scanner/src/__tests__/sast.test.ts","line":87,"malware":false},{"ruleId":"js-shell-exec-interpolation","title":"shell execution with an interpolated string","severity":"low","category":"code","cwe":"CWE-78","file":"source/modules/code-scanner/src/__tests__/sast.test.ts","line":102,"malware":false},{"ruleId":"js-shell-exec-interpolation","title":"shell execution with an interpolated string","severity":"low","category":"code","cwe":"CWE-78","file":"source/modules/code-scanner/src/__tests__/sast.test.ts","line":108,"malware":false},{"ruleId":"js-path-traversal","title":"file path built from a variable","severity":"low","category":"code","cwe":"CWE-22","file":"source/modules/code-scanner/src/__tests__/sast.test.ts","line":118,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"low","category":"code","cwe":"CWE-95","file":"source/modules/code-scanner/src/__tests__/sast.test.ts","line":137,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"low","category":"code","cwe":"CWE-95","file":"source/modules/code-scanner/src/__tests__/sast.test.ts","line":146,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"low","category":"code","cwe":"CWE-95","file":"source/modules/code-scanner/src/__tests__/sast.test.ts","line":159,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"low","category":"code","cwe":"CWE-95","file":"source/modules/code-scanner/src/__tests__/sast.test.ts","line":165,"malware":false},{"ruleId":"secret-private-key","title":"Private Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/modules/code-scanner/src/__tests__/secrets.test.ts","line":36,"malware":false},{"ruleId":"secret-database-url","title":"Database URL with credentials","severity":"low","category":"secret","cwe":"CWE-798","file":"source/modules/code-scanner/src/__tests__/secrets.test.ts","line":124,"malware":false},{"ruleId":"secret-github-token","title":"GitHub Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/modules/code-scanner/src/__tests__/secrets.test.ts","line":138,"malware":false},{"ruleId":"secret-aws-access-key","title":"AWS Access Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/modules/code-scanner/src/__tests__/secrets.test.ts","line":145,"malware":false},{"ruleId":"secret-aws-access-key","title":"AWS Access Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/modules/code-scanner/src/__tests__/secrets.test.ts","line":155,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/modules/code-scanner/src/__tests__/secrets.test.ts","line":184,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/modules/code-scanner/src/__tests__/secrets.test.ts","line":189,"malware":false},{"ruleId":"secret-database-url","title":"Database URL with credentials","severity":"low","category":"secret","cwe":"CWE-798","file":"source/modules/code-scanner/src/__tests__/secrets.test.ts","line":244,"malware":false},{"ruleId":"sql-string-concatenation","title":"SQL assembled by concatenation or interpolation","severity":"low","category":"code","cwe":"CWE-89","file":"source/packages/scan/src/__tests__/code-rules.test.ts","line":21,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"low","category":"code","cwe":"CWE-89","file":"source/packages/scan/src/__tests__/code-rules.test.ts","line":31,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"low","category":"code","cwe":"CWE-89","file":"source/packages/scan/src/__tests__/code-rules.test.ts","line":35,"malware":false},{"ruleId":"sql-string-concatenation","title":"SQL assembled by concatenation or interpolation","severity":"low","category":"code","cwe":"CWE-89","file":"source/packages/scan/src/__tests__/code-rules.test.ts","line":40,"malware":false},{"ruleId":"sql-string-concatenation","title":"SQL assembled by concatenation or interpolation","severity":"low","category":"code","cwe":"CWE-89","file":"source/packages/scan/src/__tests__/code-rules.test.ts","line":49,"malware":false},{"ruleId":"sql-string-concatenation","title":"SQL assembled by concatenation or interpolation","severity":"low","category":"code","cwe":"CWE-89","file":"source/packages/scan/src/__tests__/code-rules.test.ts","line":53,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"low","category":"code","cwe":"CWE-89","file":"source/packages/scan/src/__tests__/code-rules.test.ts","line":76,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"low","category":"code","cwe":"CWE-89","file":"source/packages/scan/src/__tests__/code-rules.test.ts","line":79,"malware":false},{"ruleId":"js-shell-exec-interpolation","title":"shell execution with an interpolated string","severity":"low","category":"code","cwe":"CWE-78","file":"source/packages/scan/src/__tests__/code-rules.test.ts","line":87,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"low","category":"code","cwe":"CWE-1333","file":"source/packages/scan/src/__tests__/code-rules.test.ts","line":164,"malware":false},{"ruleId":"js-unsafe-yaml-load","title":"YAML parsed with type resolution enabled","severity":"low","category":"code","cwe":"CWE-502","file":"source/packages/scan/src/__tests__/code-rules.test.ts","line":257,"malware":false},{"ruleId":"js-unsafe-yaml-load","title":"YAML parsed with type resolution enabled","severity":"low","category":"code","cwe":"CWE-502","file":"source/packages/scan/src/__tests__/code-rules.test.ts","line":261,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/packages/scan/src/__tests__/code-rules.test.ts","line":604,"malware":false},{"ruleId":"insecure-randomness-for-secret","title":"predictable randomness used for a security value","severity":"low","category":"code","cwe":"CWE-338","file":"source/packages/scan/src/__tests__/code-rules.test.ts","line":803,"malware":false},{"ruleId":"js-cors-wildcard-credentials","title":"wildcard CORS origin with credentials","severity":"low","category":"code","cwe":"CWE-942","file":"source/packages/scan/src/__tests__/code-rules.test.ts","line":837,"malware":false},{"ruleId":"js-cookie-insecure-flag","title":"cookie set with Secure disabled","severity":"low","category":"code","cwe":"CWE-614","file":"source/packages/scan/src/__tests__/code-rules.test.ts","line":846,"malware":false},{"ruleId":"js-hardcoded-crypto-key","title":"hardcoded key material","severity":"low","category":"code","cwe":"CWE-321","file":"source/packages/scan/src/__tests__/code-rules.test.ts","line":853,"malware":false},{"ruleId":"js-nosql-injection","title":"NoSQL query built from request data","severity":"low","category":"code","cwe":"CWE-943","file":"source/packages/scan/src/__tests__/code-rules.test.ts","line":927,"malware":false},{"ruleId":"js-predictable-cipher-iv","title":"static initialization vector","severity":"low","category":"code","cwe":"CWE-329","file":"source/packages/scan/src/__tests__/code-rules.test.ts","line":967,"malware":false}]}}