Production-readiness scan · 2026-05-10
viktorkubica/n8n-webhook-app
Needs major work before production.
Fix first
axios@1.10.0 has 17 unmitigated CVEs including three with active exploits
package.json declares axios@^1.10.0 and the OSV scan confirms 17 CVEs: GHSA-3p68-rc4w-qgx5, GHSA-3w6x-2g7m-8v23, GHSA-43fc-jf86-j433 are visible in the fetch results. This is a runtime dependency used for n8n webhook calls in src/. Any customer-facing traffic is vulnerable to SSRF or credential-leak attacks. Upgrading to axios@1.11.0+ is required before any deployment.
Zero production-grade tests and no CI pipeline
src/App.test.js is the only test file and it is the default CRA boilerplate with no assertions against custom app logic; .github/workflows is absent, so there is no automated test execution. Any code change is deployed blind.
No error tracking or structured observability
No Sentry, DataDog, or equivalent instrumentation is installed; reportWebVitals.js exists in src/ but nothing sends those signals to a backend; unhandled React errors in production will silently fail for users with no trace.
Nine dimensions
Top findings (AI)
axios@1.10.0 has 17 unmitigated CVEs including three with active exploits
package.json declares axios@^1.10.0 and the OSV scan confirms 17 CVEs: GHSA-3p68-rc4w-qgx5, GHSA-3w6x-2g7m-8v23, GHSA-43fc-jf86-j433 are visible in the fetch results. This is a runtime dependency used for n8n webhook calls in src/. Any customer-facing traffic is vulnerable to SSRF or credential-leak attacks. Upgrading to axios@1.11.0+ is required before any deployment.
Zero production-grade tests and no CI pipeline
src/App.test.js is the only test file and it is the default CRA boilerplate with no assertions against custom app logic; .github/workflows is absent, so there is no automated test execution. Any code change is deployed blind.
No error tracking or structured observability
No Sentry, DataDog, or equivalent instrumentation is installed; reportWebVitals.js exists in src/ but nothing sends those signals to a backend; unhandled React errors in production will silently fail for users with no trace.
Default README with unknown license creates legal exposure
README.md is the verbatim CRA starter with no project-specific description; license field is 'unknown'. If this is shipped to paying customers, the IP posture is indefensible in a due-diligence review.
No build-time security gate for dependencies
Dockerfile runs npm ci but never runs npm audit or a container vuln scan; the axios CVEs would be present in every built image unless manually patched before each build.
App_origos.js is unmaintained dead code in the tree
src/App_origos.js exists alongside src/App.js with no clear purpose; this file increases attack surface for zero benefit and suggests a disorganized development workflow.
Report sections
Open a section for the evidence that drove the score. If you open one first, start with Dependencies.
What this scan inspected
This scan predates coverage reporting, so what it inspected was not recorded. Re-scan the repository for a report that states its own coverage.
Every section above links to the evidence behind it. Nothing on this page is asserted without a source.