gitsafehub
github.com/helpmefindaname/doctr ↗

helpmefindaname/doctr

scanned 2026-08-07 · git 3f116ad
1 of 6 checks flagged a security issue
🔴 Needs attention
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies✓Known OSS vulnerabilities130Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ none found ✓

Packages you depend on that have known security holes (CVEs).

Nothing found by this check. ✓

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 130 found · 10 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2022-42992 All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole (CVE-2022-24439). Fix: Update that package to its patched version.
  • Serious PYSEC-2023-137 GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole (CVE-2023-40267). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-2161 GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options))
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole (CVE-2026-42284). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-457 Arbitrary Code Execution in Pillow
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole (CVE-2023-50447). Fix: Update that package to its patched version.
  • Serious PYSEC-2023-238 Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parque
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole (CVE-2023-47248). Fix: Update that package to its patched version.
  • Serious PYSEC-2022-42992 All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/tf-requirements.txt
    A package you depend on has a known security hole (CVE-2022-24439). Fix: Update that package to its patched version.
  • Serious PYSEC-2023-137 GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/tf-requirements.txt
    A package you depend on has a known security hole (CVE-2023-40267). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-2161 GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options))
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/tf-requirements.txt
    A package you depend on has a known security hole (CVE-2026-42284). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-457 Arbitrary Code Execution in Pillow
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/tf-requirements.txt
    A package you depend on has a known security hole (CVE-2023-50447). Fix: Update that package to its patched version.
  • Serious PYSEC-2023-238 Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parque
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/tf-requirements.txt
    A package you depend on has a known security hole (CVE-2023-47248). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2022-248 Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vulnerable to a directory traversal attack that could leak data
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole (CVE-2022-35918). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2024-153 Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static file sharing feature. Users of hosted Strea
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole (CVE-2024-42474). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-212 A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the component Palette Handler. Such manipulation le
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole (CVE-2026-10804). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2285 Streamlit is a data oriented application development framework for python. Streamlit Open Source versions prior to 1.54.0 running on Windows hosts have an unauthenticated Server-Side Request Forgery (
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole (CVE-2026-33682). Fix: Update that package to its patched version.
  • Worth fixing GHSA-8qw9-gf7w-42x5 Minor fix to previous patch for CVE-2022-35918
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2132 Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole (CVE-2026-7246). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-161 GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython d
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole (CVE-2023-40590). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-165 GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file bei
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole (CVE-2023-41040). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2024-4 GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole (CVE-2024-22190). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2162 GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application u
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole (CVE-2026-44243). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2163 GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPy
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole (CVE-2026-44244). Fix: Update that package to its patched version.
  • Worth fixing GHSA-2f96-g7mh-g2hx GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole (CVE-2026-67325). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3f7w-8rr8-f37f GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-3rp5-jjmw-4wv2 GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole (CVE-2026-69097). Fix: Update that package to its patched version.
  • Worth fixing GHSA-4gmw-gg2m-w46p GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite
    /workdirs/scan-015fb7de-fe26-4c7c-9348-97c0c15a0c54/demo/pt-requirements.txt
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
… 105 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: pypi:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.