Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
Nothing found by this check. ✓
Packages you depend on that have known security holes (CVEs).
CVE-2023-41419 python-gevent: privilege escalation via a crafted script to the WSGIServer componentCVE-2020-14343 PyYAML: incomplete fix for CVE-2020-1747CVE-2022-24439 GitPython: improper user input validation leads into a RCECVE-2023-40267 GitPython: Insecure non-multi options in clone and clone_from is not blockedCVE-2023-37920 python-certifi: Removal of e-Tugra root certificateCVE-2022-23491 python-certifi: untrusted root certificatesCVE-2020-36242 python-cryptography: Large inputs for symmetric encryption can trigger integer overflow leading to buffer overflowCVE-2023-0286 openssl: X.400 address type confusion in X.509 GeneralNameCVE-2023-50782 python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659CVE-2026-26007 cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT CurvesCVE-2026-69249 python-cryptography is a package designed to expose cryptographic prim ...GHSA-537c-gmf6-5ccf Vulnerable OpenSSL included in cryptography wheelsCVE-2023-23931 python-cryptography: memory corruption via immutable objectsCVE-2023-49083 python-cryptography: NULL-dereference when loading PKCS7 certificatesCVE-2024-0727 openssl: denial of service via null dereferenceCVE-2026-69248 cryptography is a package designed to expose cryptographic primitives ...CVE-2023-30861 flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie headerCVE-2024-3651 python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode()CVE-2026-45409 python-idna: idna: Denial of Service via specially crafted long inputsCVE-2020-28493 python-jinja2: ReDoS vulnerability in the urlize filterCVE-2024-22195 jinja2: HTML attribute injection when passing user input as keys to xmlattr filterCVE-2024-34064 jinja2: accepts keys containing non-attribute charactersCVE-2024-56326 jinja2: Jinja has a sandbox breakout through indirect reference to format methodCVE-2025-27516 jinja2: Jinja sandbox breakout through attr filter selecting format methodCVE-2022-40023 python-mako: REDoS in Lexer classYour dependencies cross-checked against the OSV vulnerability database.
PYSEC-2021-63 In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstratedPYSEC-2023-177 An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component.PYSEC-2021-142 A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or PYSEC-2022-42992 All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clonePYSEC-2023-137 GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.PYSEC-2026-2161 GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options))PYSEC-2022-42986 Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates fromPYSEC-2023-135 Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. These are in the process of being removed from Mozilla's trust store. e-Tugra's root certificates are being removed purPYSEC-2024-230 Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.PYSEC-2026-2132 Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.PYSEC-2023-11 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the bufferPYSEC-2023-254 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-poinPYSEC-2026-1283 Python Cryptography package vulnerable to Bleichenbacher timing oracle attackPYSEC-2026-1285 Null pointer dereference in PKCS12 parsingPYSEC-2026-2141 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipPYSEC-2026-35 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certPYSEC-2026-3553 python-cryptography: Duplicate self-signed intermediates can cause exponential path-buildingPYSEC-2026-3554 python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtreesPYSEC-2026-800 Vulnerable OpenSSL included in cryptography wheelsGHSA-537c-gmf6-5ccf Vulnerable OpenSSL included in cryptography wheelsPYSEC-2023-62 Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxyPYSEC-2026-2151 Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a UsGHSA-656c-6cxf-hvcv Deserialization of Untrusted Data in Flask-CachingPYSEC-2024-60 A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings,PYSEC-2026-215 Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions priorCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.