Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
Nothing found by this check. ✓
Packages you depend on that have known security holes (CVEs).
CVE-2025-43859 h11: h11 accepts some malformed Chunked-Encoding bodiesCVE-2026-26007 cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT CurvesCVE-2026-69249 python-cryptography is a package designed to expose cryptographic prim ...GHSA-537c-gmf6-5ccf Vulnerable OpenSSL included in cryptography wheelsCVE-2026-69248 cryptography is a package designed to expose cryptographic primitives ...CVE-2026-45409 python-idna: idna: Denial of Service via specially crafted long inputsCVE-2024-12797 openssl: RFC7250 handshakes with unauthenticated servers don't abort as expectedCVE-2026-34073 python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validationCVE-2026-4539 pygments: Pygments: Denial of Service via inefficient regular expression processing in AdlLexerYour dependencies cross-checked against the OSV vulnerability database.
PYSEC-2026-348 h11 accepts some malformed Chunked-Encoding bodiesPYSEC-2026-2132 Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.PYSEC-2026-2141 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipPYSEC-2026-35 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certPYSEC-2026-3553 python-cryptography: Duplicate self-signed intermediates can cause exponential path-buildingPYSEC-2026-3554 python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtreesGHSA-537c-gmf6-5ccf Vulnerable OpenSSL included in cryptography wheelsPYSEC-2026-215 Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions priorPYSEC-2026-1845 pytest has vulnerable tmpdir handlingPYSEC-2026-1872 Requests vulnerable to .netrc credentials leak via malicious URLsPYSEC-2026-2275 Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system tePYSEC-2026-141 urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=FalPYSEC-2026-1994 urllib3 streaming API improperly handles highly compressed dataPYSEC-2026-1996 Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)PYSEC-2026-1997 urllib3 does not control redirects in browsers and Node.jsPYSEC-2026-1998 urllib3 allows an unbounded number of links in the decompression chainPYSEC-2026-1999 urllib3 redirects are not disabled when retries are disabled on PoolManager instantiationPYSEC-2026-2987 Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID MatchingPYSEC-2026-1284 Vulnerable OpenSSL included in cryptography wheelsCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.