gitsafehub
github.com/google/dopamine ↗

google/dopamine

scanned 2026-06-30 · git 5873f54
1 of 6 checks flagged a security issue
🔴 Needs attention
Only 3 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secretsVulnerable dependenciesKnown OSS vulnerabilities83Risky code patternsMalicious dependenciesProject health

Security checks

Leaked secrets — Gitleaks timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 30s

Vulnerable dependencies — Trivy none found ✓

Packages you depend on that have known security holes (CVEs).

Nothing found by this check. ✓

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scanner 83 found · 7 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2021-137 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2021-25287). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-138 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2021-25288). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-331 Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2021-34552). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-35 An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOT
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2021-25289). Fix: Update that package to its patched version.
  • Serious PYSEC-2022-10 PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2022-22817). Fix: Update that package to its patched version.
  • Serious PYSEC-2022-168 Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2022-24303). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-457 Arbitrary Code Execution in Pillow
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2023-50447). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-89 Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Ma
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2025-69534). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-139 An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Imag
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2021-28675). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-317 The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2021-23437). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-36 An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2021-25290). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-37 An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2021-25291). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-38 An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2021-25292). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-39 An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2021-25293). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-40 Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2021-27921). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-41 Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempt
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2021-27922). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-42 Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempte
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2021-27923). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-69 In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2020-35653). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-70 In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2020-35654). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-71 In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2020-35655). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-92 An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2021-28676). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-93 An issue was discovered in Pillow before 8.2.0. For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \r and \n as line endings. It used an accidentally qu
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2021-28677). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-94 An issue was discovered in Pillow before 8.2.0. For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2021-28678). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2022-42979 Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2022-45198). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2022-8 path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.
    /workdirs/scan-ca2cc053-bbd9-4df2-b17e-c3e93037c933/requirements.txt
    A package you depend on has a known security hole (CVE-2022-22815). Fix: Update that package to its patched version.
… 58 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrep none found ✓

Code that can be exploited — injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddog timed out

Packages that look intentionally malicious — typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: pypi:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecard didn’t run

Maintenance & supply-chain hygiene. A signal about the project — not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.