Date: 2026-06-22 Scope: 18
repositories (~2,775 files, ~438K LOC) Tools used: - pdpa-sg-clj —
PII/secret/NRIC scanner (critical: NRIC, SG phone, email; high: AWS
keys, Stripe, GitHub tokens, private keys; medium: passwords, secrets) -
trufflehog — git-history secret scanning
- detect-secrets (Yelp) — entropy-based secret
detection
- npm audit — Node.js dependency vulnerability
scanner
- safety (PyUp) — Python dependency vulnerability
scanner
- pip-audit — Python CVE scanner
- OWASP dependency-check methodology — applied via
combination of npm audit, safety, pip-audit
Overall verdict: Low severity. No PII leaks, no
committed credentials, no API keys in git history. Minor dependency
vulnerabilities in two Node.js repos and configuration hardening
opportunities.
1. PII & Secret Scan
(pdpa-sg-clj)
| Severity |
Count |
Details |
| CRITICAL |
0 |
No NRIC/FIN, SG phone, or live emails detected |
| HIGH |
0 |
No AWS keys, Stripe keys, GitHub tokens, or private keys |
| MEDIUM |
0 |
No hardcoded passwords or secrets |
| LOW |
0 |
No emails (excluding example domains) |
All 18 repos are clean.
2. Git History Secret Scan
(trufflehog)
| Result |
Count |
Details |
| True positives |
0 |
No committed secrets found |
| False positives |
1 |
Git SHA reference in nurazhar.com/bb.edn
(github.borkdude/quickblog {:git/sha "c542bdd..."}) — not a
real secret |
3. Static Secret
Detection (detect-secrets)
0 findings across all 18 repos. No base64-encoded
secrets, high-entropy strings, or credential patterns detected.
4. Dependency Vulnerability
Scan
Node.js Repos (npm audit)
| Repository |
Vulns |
Severity |
Key Issues |
| lagu-lagu |
N/A |
Info |
No package-lock.json — audit skipped |
| lithan_smartshop |
3 |
1 moderate, 2 high |
vite/esbuild dep, form-data
CRLF injection |
| president-dao |
20 |
1 low, 9 moderate, 10 high |
gittar/tar, yaml stack
overflow, 17 others |
Python Repos (safety /
pip-audit)
| Repository |
Vulns |
Notes |
| lithan-dev-sandbox |
0 |
62 unpinned dependency warnings — pin deps to enable full
scanning |
| lithan_smartshop (backend) |
N/A |
No root-level requirements.txt |
Clojure Repos
nvd-clojure (OWASP NVD wrapper) not available on this
system. Library versions are recent (Clojure 1.12.0, Cheshire 5.13.0,
Ring 1.13.0). Notable:
- headhunter-agent still on Clojure
1.11.1 (others on 1.12.0)
- hiccup is at 2.0.0-RC3 (release
candidate) in 3 projects
5. Exposed Credential Files
| Repository |
File |
Status |
Risk |
| president-dao |
.env with PRIVATE_KEY |
Local only (not tracked in git) |
Medium — no .gitignore exists;
accidental commit risk |
| lithan_assignments |
.env.example (2 files) |
Committed (templates only) |
Low |
| lithan_smartshop |
.env.example |
Committed (template only) |
Low |
Action required: Add .env to
.gitignore in president-dao.
6. Missing Security Controls
| Issue |
Repos Affected |
No .gitignore |
president-dao |
No package-lock.json committed |
lagu-lagu |
| Unpinned Python deps (>= ranges) |
lithan-dev-sandbox |
| No CI/CD security scan workflow |
All repos |
| No pre-commit hook for secret detection |
All repos |
7. Per-Repository Summary
1 | agent-bond | Clojure | ✅ Clean |
2 | aur-audit | Clojure | ✅ Clean |
3 | bitcoin-wiki | Documentation | ✅ Clean
|
4 | nurazhar.com | Clojure (Babashka blog) | ✅
Clean |
5 | bsv-clj | Clojure | ✅ Clean |
6 | bsv-de-tracker | Clojure | ✅ Clean |
7 | bunker | Clojure | ✅ Clean |
8 | headhunter-agent | Clojure | ✅ Clean (⚠
older Clojure 1.11.1) |
9 | ipso-agent | Clojure | ✅ Clean |
10
10 | lagu-lagu | Node.js | ⚠ No lockfile |
11 | lithan_assignments | Mixed coursework | ✅
Clean |
12 | lithan_smartshop | Node + Docker | ⚠ 3 npm
vulns, unpinned Python deps |
13 | lithan-dev-sandbox | Python + Node | ⚠
Unpinned deps (62 warnings) |
14 | nurazhardotcom | Static site | ✅ Clean
|
15 | original-bitcoin-awesome | Documentation |
✅ Clean |
16 | paperclip-clj | Clojure | ✅ Clean |
17 | pdpa-sg-clj | Clojure | ✅ Clean
(self-audited) |
18 | president-dao | Node/TypeScript | ⚠ 20 npm
vulns, .env not gitignored |
All recommendations have been implemented and pushed as of
2026-06-22.
| # |
Action |
Status |
Details |
| 1 |
president-dao: .gitignore + rotate
private key |
✅ Done |
.gitignore created; old key cW7Bm7...
rotated to new testnet address mxiKjXx5... |
| 2 |
president-dao: Fix 20 npm vulns |
✅ Partial |
7 fixable applied; 13 remain (scrypt-ts framework deps — no upstream
fix yet) |
| 3 |
lithan_smartshop: Fix 3 npm vulns |
✅ Partial |
form-data CRLF fixed; vite/esbuild 2 remain (need
--force major upgrade) |
Short-term (Medium
Priority) — ✅ Completed
| # |
Action |
Status |
Details |
| 4 |
lagu-lagu: Generate
package-lock.json |
✅ Done |
65KB lockfile committed |
| 5 |
lithan-dev-sandbox: Pin Python deps |
✅ Done |
All 11 deps pinned to exact versions |
| 6 |
headhunter-agent: Clojure 1.11.1 → 1.12.0 |
✅ Done |
Updated in deps.edn |
Ongoing (Low Priority) — ✅
Implemented
| # |
Action |
Status |
Details |
| 7 |
GitHub Action secret scanning workflow |
✅ Done |
gitleaks/gitleaks-action@v2 added to all 18
repos |
| 8 |
nvd-clojure CI pipeline |
✅ Done |
Weekly vulnerability scan added to all 8 Clojure
repos |
| 9 |
Pre-commit hooks (detect-secrets) |
✅ Done |
.pre-commit-config.yaml added to all 18
repos |
Report generated 2026-06-22 using pdpa-sg-clj v0.1.0, trufflehog,
detect-secrets, npm audit, safety, and pip-audit. Remediation applied
same day and pushed to all 18 repositories.