gitsafehub
github.com/anikchand461/wiseclick ↗

anikchand461/wiseclick

scanned 2026-08-09 · git 77dcf02
1 of 6 checks flagged a security issue
🟡 Worth a look
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies✓Known OSS vulnerabilities12Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ none found ✓

Packages you depend on that have known security holes (CVEs).

Nothing found by this check. ✓

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 12 found

Your dependencies cross-checked against the OSV vulnerability database.

  • Worth fixing PYSEC-2024-38 FastAPI is a web framework for building APIs with Python 3.8+ based on standard Python type hints. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` h
    /workdirs/scan-411d3e10-0a9c-4b82-95d8-12a1267c886a/server/requirements.txt
    A package you depend on has a known security hole (CVE-2024-24762). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-150 This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour o
    /workdirs/scan-411d3e10-0a9c-4b82-95d8-12a1267c886a/server/requirements.txt
    A package you depend on has a known security hole (CVE-2020-7694). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-151 Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or e
    /workdirs/scan-411d3e10-0a9c-4b82-95d8-12a1267c886a/server/requirements.txt
    A package you depend on has a known security hole (CVE-2020-7695). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-215 Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior
    /workdirs/scan-411d3e10-0a9c-4b82-95d8-12a1267c886a/server/requirements.txt
    A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1812 Pydantic regular expression denial of service
    /workdirs/scan-411d3e10-0a9c-4b82-95d8-12a1267c886a/server/requirements.txt
    A package you depend on has a known security hole (CVE-2024-3772). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-161 BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks
    /workdirs/scan-411d3e10-0a9c-4b82-95d8-12a1267c886a/server/requirements.txt
    A package you depend on has a known security hole (CVE-2026-48710). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1941 Starlette has possible denial-of-service vector when parsing large files in multipart forms
    /workdirs/scan-411d3e10-0a9c-4b82-95d8-12a1267c886a/server/requirements.txt
    A package you depend on has a known security hole (CVE-2025-54121). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1943 Starlette Denial of service (DoS) via multipart/form-data
    /workdirs/scan-411d3e10-0a9c-4b82-95d8-12a1267c886a/server/requirements.txt
    A package you depend on has a known security hole (CVE-2024-47874). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2280 Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attr
    /workdirs/scan-411d3e10-0a9c-4b82-95d8-12a1267c886a/server/requirements.txt
    A package you depend on has a known security hole (CVE-2026-48817). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2281 Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to i
    /workdirs/scan-411d3e10-0a9c-4b82-95d8-12a1267c886a/server/requirements.txt
    A package you depend on has a known security hole (CVE-2026-48818). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-248 Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating
    /workdirs/scan-411d3e10-0a9c-4b82-95d8-12a1267c886a/server/requirements.txt
    A package you depend on has a known security hole (CVE-2026-54282). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-249 Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are e
    /workdirs/scan-411d3e10-0a9c-4b82-95d8-12a1267c886a/server/requirements.txt
    A package you depend on has a known security hole (CVE-2026-54283). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.