yahia-SA/together

Based on automated scanner findings, this repository is not production-ready. Two high-severity CVEs in a direct dependency create an immediate security risk that must be resolved before deployment.

→ The scanner detected CVE-2023-39137 and CVE-2023-39139 in archive@3.1.6 listed in pubspec.lock. Both are flagged as high severity and represent known vulnerabilities in an active dependency.

→ No test suite was detected by the scanner, meaning there is no automated verification that the codebase functions as intended.

→ No LICENSE file is present, which creates legal ambiguity about usage rights and distribution permissions.

Update the archive dependency from version 3.1.6 to a patched version that resolves CVE-2023-39137 and CVE-2023-39139. This is in pubspec.lock and should be addressed immediately—both CVEs are rated high severity. Verify the actual impact against your code since some CVE severity ratings may not apply to all use cases, but the presence of known vulnerabilities in dependencies is a blocker for production use.

ADDITIONAL NOTES

The repository has no automated testing framework configured and lacks standard project documentation files (SECURITY.md, CODEOWNERS, LICENSE, and CI/CD configuration). While these are best-practice gaps rather than security issues, they indicate the project is in early stages. Security and secrets scanning returned clean results, which is positive. Address the dependency vulnerabilities first, then consider adding basic tests and documentation for production readiness.