Shipped library with a known vulnerability

This is the one dependency finding that works without repository access: whatever the app ships to every visitor, anyone can read — including the version of a bundled library. If a public advisory (CVE/GHSA) exists for it, the hole is documented, comes with sample code and is probed automatically. The question is not whether someone finds it, but when a scanner passes your address.

Generated projects accumulate this fast. The version sits in the bundle exactly as the model knew it when scaffolding — and for an MVP, more time usually passes between scaffolding and launch than between an advisory and mass exploitation. Updating front-end libraries is one of the things that simply never happens in a vibe-coded project.

Check it yourself: open the developer tools, load the library file from the network tab and read its version line; the CVE/GHSA identifier leads to the public description. We do not guess: if the version cannot be determined with confidence, the finding stays silent.