What is the Neural Link?

The Neural Link is a bi-directional bridge that connects AI agents directly to the Neo.mjs runtime. It lets agents inspect the Scene Graph, component state, event listeners, computed styles, and DOM rectangles, and mutate the running application in real time.

Why is Neo.mjs called an Application Engine instead of a framework?

Neo.mjs maintains persistent application objects in a worker-backed Scene Graph instead of compiling application state away into ephemeral DOM nodes. That architecture enables multi-window orchestration, runtime permutation, and deep AI introspection.

What is Context Engineering?

Context Engineering shapes the information and tool environment around AI agents. Neo.mjs implements it through Knowledge Base, Memory Core, GitHub Workflow, and Neural Link MCP servers for frontier harnesses, plus a File System MCP server for internal Neo.ai.Agent local loops.

What is the Neo.mjs Agent OS?

The Neo.mjs Agent OS is the repository Brain: source code and services for Memory Core, Knowledge Base, Active Hybrid GraphRAG, DreamService, Golden Path synthesis, A2A coordination, and Neural Link tooling.

Neo.mjs - Self-Evolving Software Organism

Frontmatter

title	Security: Fix vulnerabilities found by automated scan
author	NLmejiro
state	Closed
createdAt	Mar 31, 2026, 8:17 AM
updatedAt	Mar 31, 2026, 9:36 AM
closedAt	Mar 31, 2026, 8:29 AM
mergedAt
branches	`main` ← `fix/security-findings-20260331-061224`
url	https://github.com/neomjs/neo/pull/9605

Closed

NLmejiro commented on Mar 31, 2026, 8:17 AM

Security Findings Summary

Total: 41
Critical: 9
High: 32

Findings

[CRITICAL] gitleaks: generic-api-key in /tmp/scan_targets/neo/apps/covid/view/mapboxGl/Component.mjs:17 Secret leak: Detected a Generic API Key, potentially exposing access to various services and sensitive operations. | Mat
[CRITICAL] gitleaks: generic-api-key in /tmp/scan_targets/neo/apps/devindex/resources/data/users.jsonl:27682 Secret leak: Detected a Generic API Key, potentially exposing access to various services and sensitive operations. | Mat
[CRITICAL] gitleaks: generic-api-key in /tmp/scan_targets/neo/apps/devindex/resources/data/users.jsonl:39224 Secret leak: Detected a Generic API Key, potentially exposing access to various services and sensitive operations. | Mat
[CRITICAL] gitleaks: generic-api-key in /tmp/scan_targets/neo/apps/sharedcovid/view/mapboxGl/Component.mjs:17 Secret leak: Detected a Generic API Key, potentially exposing access to various services and sensitive operations. | Mat
[CRITICAL] gitleaks: jwt in /tmp/scan_targets/neo/examples/component/wrapper/cesiumJS/neo-config.json:4 Secret leak: Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user da
[CRITICAL] gitleaks: gcp-api-key in /tmp/scan_targets/neo/examples/component/wrapper/googleMaps/neo-config.json:5 Secret leak: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches
[CRITICAL] gitleaks: gcp-api-key in /tmp/scan_targets/neo/learn/tutorials/Earthquakes.md:1207 Secret leak: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches
[CRITICAL] gitleaks: gcp-api-key in /tmp/scan_targets/neo/resources/data/deck/training/pages/2022-12-31T22-11-55-555Z.md:33 Secret leak: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches
[CRITICAL] gitleaks: gcp-api-key in /tmp/scan_targets/neo/resources/data/deck/training/pages/2023-01-01T21-14-45-740Z.md:37 Secret leak: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches
[HIGH] semgrep: generic.secrets.security.detected-jwt-token.detected-jwt-token in /tmp/scan_targets/neo/apps/covid/view/mapboxGl/Component.mjs:17 JWT token detected ... and 31 more findings

NLmejiro commented on Mar 31, 2026, 8:29 AM

Closing: this PR was created by automated scanning but contained no actual code fixes. Apologies for the noise.

tobiu commented on Mar 31, 2026, 8:59 AM

@NLmejiro Thanks for the report. Most items are actually fully intentional: the neo website is hosted on github pages, and there are demos for e.g. CesiumJS, MapboxGL, Googlemaps. Since there is no backend, this is the only way to show the content. "Free" API keys though, so not much damage can happen (except for hitting rate limits).

devindex app: if a user would enter an api key on their public github profile, it would appear here.

trainings deck: this is old code from @maxrahder . those keys could get removed.

in case you want to do a PR, please use the latest version of the dev branch as the base. re-added 9k historical commits is impossible.

NLmejiro commented on Mar 31, 2026, 9:36 AM

@tobiu Thank you for the detailed explanation — really appreciate you taking the time.

You're right, the demo API keys for GitHub Pages make complete sense. We'll improve our scanning pipeline to filter out intentional frontend demo keys and non-actionable historical commit findings.

If we find time to clean up the training deck keys from @maxrahder's old code, we'll submit a proper PR against the dev branch.

Again, apologies for the noise and thanks for the guidance.