June 2026 Security Audit: 158 Alerts Reviewed, 0 Confirmed Exploitable

In June 2026 we ran a comprehensive security audit across the Zeros Host platform. This post summarises what we looked at, what we found, and what we did about it.

What we audited

The audit covered two areas:

• Dependabot alerts - GitHub's automated dependency scanner had flagged 158 open alerts across our codebase. We triaged all of them, focusing on the ones marked runtime severity critical or high.
• Wings security advisories - Wings is the server-side daemon that manages your game servers. We reviewed 11 published security advisories (GHSAs) that applied to the version we run.

What we found

The short answer: none of the 158 Dependabot alerts were confirmed exploitable in our deployment.

The slightly longer answer is that a vulnerability being flagged by a scanner does not mean it is reachable. Each alert requires a chain: the vulnerable code must be called, with input that reaches it from outside, through a path that exists in how we have deployed the software. In every case we checked, that chain was broken somewhere.

Some examples of how alerts were ruled out:

• Several XML parser vulnerabilities applied only to a specific protocol that our API does not expose - the vulnerable code path is simply never called.
• Three Docker-related vulnerabilities affect the Docker daemon itself. Our server management component (Wings) is a Docker client, not the daemon - the vulnerable surfaces are not ours to exploit.
• A number of JavaScript alerts affected build tooling only - libraries used during the build process that are never shipped to or executed by users.

For the Wings advisories, the picture was similar. Of the 11 advisories we reviewed:

• Nine were already fixed by upstream patches that were present in our codebase.
• One was patched by us during this audit (see below).
• One had already been addressed by a separate fix we shipped earlier.

The one thing we patched

One advisory - relating to file permission handling during container operations - was still present in our tree when the audit ran. We patched it immediately. The fix ensures that symbolic links created inside a container cannot be used to write to locations outside the container's expected filesystem scope. This was a medium-severity finding and required no customer action - it was fixed at the infrastructure level.

What is still being monitored

Two Docker vulnerabilities have no available fix for the version line we currently run. Both require an attacker to already have control of the Docker daemon itself, which is not a customer-accessible component. We have documented these explicitly and will apply patches when the upstream project makes them available.

One direct dependency - used for sending email - has a patch available as a major version upgrade. The vulnerability requires a crafted email address to trigger, and our signup validation filters addresses before they reach the vulnerable function. Patching it is on our list regardless, and we will complete it before any scenario where the fallback email path becomes active.

Our approach to security

We do not treat a zero-exploitable result as a reason to stop looking. Security audits are scheduled, not reactive. The value is in finding things before they matter, not after.

If you have a security concern about Zeros Host, contact us at [email protected]. We take all reports seriously and respond within 24 hours.