ehazlett/tekken

API keys, passwords or tokens committed into the repo.

• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  config.py:40
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2017-18342 PyYAML: yaml.load() API could execute arbitrary code
  requirements.txt
  A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
• Serious CVE-2020-14343 PyYAML: incomplete fix for CVE-2020-1747
  requirements.txt
  A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-42771 python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code
  requirements.txt
  A package you depend on has a known security hole (CVE-2021-42771). Fix: Update that package to its patched version.
• Worth fixing CVE-2018-1000656 python-flask: Denial of Service via crafted JSON file
  requirements.txt
  A package you depend on has a known security hole (CVE-2018-1000656). Fix: Update that package to its patched version.
• Worth fixing CVE-2019-1010083 python-flask: unexpected memory usage can lead to denial of service via crafted encoded JSON data
  requirements.txt
  A package you depend on has a known security hole (CVE-2019-1010083). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-30861 flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header
  requirements.txt
  A package you depend on has a known security hole (CVE-2023-30861). Fix: Update that package to its patched version.
• Worth fixing CVE-2014-1402 python-jinja2: FileSystemBytecodeCache insecure cache temporary file use
  requirements.txt
  A package you depend on has a known security hole (CVE-2014-1402). Fix: Update that package to its patched version.
• Worth fixing CVE-2016-10745 python-jinja2: Sandbox escape due to information disclosure via str.format
  requirements.txt
  A package you depend on has a known security hole (CVE-2016-10745). Fix: Update that package to its patched version.
• Worth fixing CVE-2019-10906 python-jinja2: str.format_map allows sandbox escape
  requirements.txt
  A package you depend on has a known security hole (CVE-2019-10906). Fix: Update that package to its patched version.
• Worth fixing CVE-2014-0012 python-jinja2: FileSystemBytecodeCache insecure cache temporary file use, incorrect CVE-2014-1402 fix
  requirements.txt
  A package you depend on has a known security hole (CVE-2014-0012). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-28493 python-jinja2: ReDoS vulnerability in the urlize filter
  requirements.txt
  A package you depend on has a known security hole (CVE-2020-28493). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-22195 jinja2: HTML attribute injection when passing user input as keys to xmlattr filter
  requirements.txt
  A package you depend on has a known security hole (CVE-2024-22195). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-34064 jinja2: accepts keys containing non-attribute characters
  requirements.txt
  A package you depend on has a known security hole (CVE-2024-34064). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-56326 jinja2: Jinja has a sandbox breakout through indirect reference to format method
  requirements.txt
  A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-27516 jinja2: Jinja sandbox breakout through attr filter selecting format method
  requirements.txt
  A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
• Worth fixing CVE-2019-14322 Pallets Werkzeug vulnerable to Path Traversal
  requirements.txt
  A package you depend on has a known security hole (CVE-2019-14322). Fix: Update that package to its patched version.
• Worth fixing CVE-2019-14806 python-werkzeug: insufficient debugger PIN randomness vulnerability
  requirements.txt
  A package you depend on has a known security hole (CVE-2019-14806). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-25577 python-werkzeug: high resource usage when parsing multipart form data with many fields
  requirements.txt
  A package you depend on has a known security hole (CVE-2023-25577). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-34069 python-werkzeug: user may execute code on a developer's machine
  requirements.txt
  A package you depend on has a known security hole (CVE-2024-34069). Fix: Update that package to its patched version.
• Worth fixing CVE-2016-10516 python-werkzeug: Cross-site scripting in render_full function in debug/tbtools.py
  requirements.txt
  A package you depend on has a known security hole (CVE-2016-10516). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-28724 python-werkzeug: open redirect via double slash in the URL
  requirements.txt
  A package you depend on has a known security hole (CVE-2020-28724). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-49766 werkzeug: python-werkzeug: Werkzeug safe_join not safe on Windows
  requirements.txt
  A package you depend on has a known security hole (CVE-2024-49766). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-66221 Werkzeug: Werkzeug: Denial of service via Windows device names in path segments
  requirements.txt
  A package you depend on has a known security hole (CVE-2025-66221). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-21860 Werkzeug safe_join() allows Windows special device names with compound extensions
  requirements.txt
  A package you depend on has a known security hole (CVE-2026-21860). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-27199 Werkzeug safe_join() allows Windows special device names
  requirements.txt
  A package you depend on has a known security hole (CVE-2026-27199). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious PYSEC-2018-49 In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced fo
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
• Serious PYSEC-2021-142 A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2021-421 Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2021-42771). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2018-66 The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of servic
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2018-1000656). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2019-179 The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2019-1010083). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2023-62 Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2023-30861). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2151 Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Us
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2026-27205). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2014-8 The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file wit
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2014-1402). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2014-82 FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2014-0012). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2019-217 In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2019-10906). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2019-220 In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2016-10745). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2021-66 This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28493). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1471 Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1473 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2024-22195). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1474 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2024-34064). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1475 Jinja has a sandbox breakout through indirect reference to format method
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2017-43 Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2016-10516). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2019-140 Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2019-14806). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2020-157 Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28724). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2023-221 Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are ap
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2023-46136). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2023-58 Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a sm
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2023-25577). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1065 Pallets Werkzeug vulnerable to Path Traversal
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2019-14322). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2043 Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2024-34069). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2044 Werkzeug safe_join() allows Windows special device names with compound extensions
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2026-21860). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2045 Werkzeug safe_join not safe on Windows
  /workdirs/scan-d0413061-9b35-4227-9952-4130951ef279/requirements.txt
  A package you depend on has a known security hole (CVE-2024-49766). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: pypi:timeout