Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.Packages you depend on that have known security holes (CVEs).
CVE-2019-12855 python-twisted: XMPP support in words.protocols.jabber.xmlstream in Twisted does not verify certificates allowing for a MITM connectionsCVE-2020-10108 python-twisted: HTTP request smuggling when presented with two Content-Length headersCVE-2020-10109 python-twisted: HTTP request smuggling when presented with a Content-Length and a chunked Transfer-Encoding headerCVE-2022-24801 python-twisted: possible http request smugglingGHSA-32gv-6cf3-wcmq HTTP/2 DoS Attacks: Ping, Reset, and Settings FloodsCVE-2022-21712 dev-python/twisted: secret exposure in cross-origin redirectsCVE-2026-42304 python-twisted: Twisted: Denial of Service via crafted DNS packets in twisted.namesCVE-2016-1000111 Twisted: sets environmental variable based on user supplied Proxy request headerCVE-2019-12387 python-twisted: Improper neutralization of CRLF characters in URIs and HTTP methodsCVE-2022-39348 python-twisted: NameVirtualHost Host header injectionCVE-2023-46137 python-twisted: disordered HTTP pipeline response in twisted.webCVE-2024-41671 Twisted is an event-based framework for internet applications, support ...CVE-2024-41810 python-twisted: Reflected XSS via HTML Injection in Redirect ResponseGHSA-8r99-h8j2-rw64 Twisted vulnerable to HTTP Request Smuggling AttacksCVE-2022-22846 The dnslib package through 0.9.16 for Python does not verify that the ...CVE-2023-32681 python-requests: Unintended leak of Proxy-Authorization headerCVE-2024-35195 requests: subsequent requests to the same host ignore cert verificationCVE-2024-47081 requests: Requests vulnerable to .netrc credentials leak via malicious URLsCVE-2026-25645 requests: Requests: Security bypass due to predictable temporary file creationYour dependencies cross-checked against the OSV vulnerability database.
PYSEC-2019-129 In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.PYSEC-2020-259 In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value wasPYSEC-2020-260 In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainPYSEC-2022-195 Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed sevGHSA-32gv-6cf3-wcmq HTTP/2 DoS Attacks: Ping, Reset, and Settings FloodsPYSEC-2019-128 In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.PYSEC-2020-214 Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROPYSEC-2022-27 twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in tPYSEC-2023-224 Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously PYSEC-2024-75 Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows aPYSEC-2026-1055 Twisted vulnerable to NameVirtualHost Host header injectionPYSEC-2026-160 Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.4.0rc2, the twisted.names module is vulnerable to a Denial of Service (DoS) attack via resource exhauPYSEC-2026-1992 twisted.web has disordered HTTP pipeline responsePYSEC-2022-4 The dnslib package through 0.9.16 for Python does not verify that the ID value in a DNS reply matches an ID value in a query.PYSEC-2023-74 Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rePYSEC-2026-1872 Requests vulnerable to .netrc credentials leak via malicious URLsPYSEC-2026-1873 Requests `Session` object does not verify requests after making first request with verify=FalsePYSEC-2026-2275 Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system teGHSA-8r99-h8j2-rw64 Twisted vulnerable to HTTP Request Smuggling AttacksCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.