gitsafehub
github.com/jeffallan/django-allauth-demo ↗

jeffallan/django-allauth-demo

scanned 2026-08-08 · git 39cf1dd
1 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secretsVulnerable dependenciesKnown OSS vulnerabilities101Risky code patternsMalicious dependenciesProject health

Security checks

Leaked secrets — Gitleaks none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivy none found ✓

Packages you depend on that have known security holes (CVEs).

Nothing found by this check. ✓

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scanner 101 found · 16 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2020-80 In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2020-11538). Fix: Update that package to its patched version.
  • Serious PYSEC-2020-81 libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2020-5310). Fix: Update that package to its patched version.
  • Serious PYSEC-2020-82 libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2020-5311). Fix: Update that package to its patched version.
  • Serious PYSEC-2020-83 libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2020-5312). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-137 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2021-25287). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-138 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2021-25288). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-331 Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2021-34552). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-35 An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOT
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2021-25289). Fix: Update that package to its patched version.
  • Serious PYSEC-2022-10 PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2022-22817). Fix: Update that package to its patched version.
  • Serious PYSEC-2022-168 Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2022-24303). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-457 Arbitrary Code Execution in Pillow
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2023-50447). Fix: Update that package to its patched version.
  • Serious PYSEC-2019-16 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2019-19844). Fix: Update that package to its patched version.
  • Serious PYSEC-2020-35 Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data a
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2020-7471). Fix: Update that package to its patched version.
  • Serious PYSEC-2022-190 An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2022-28346). Fix: Update that package to its patched version.
  • Serious PYSEC-2022-191 A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion)
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2022-28347). Fix: Update that package to its patched version.
  • Serious GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1433 Gunicorn HTTP Request/Response Smuggling vulnerability
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements.txt
    A package you depend on has a known security hole (CVE-2024-6827). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1434 Request smuggling leading to endpoint restriction bypass in Gunicorn
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements.txt
    A package you depend on has a known security hole (CVE-2024-1135). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-920 Sentry SDK leaks sensitive session information when `sendDefaultPII` is set to `True`
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements.txt
    A package you depend on has a known security hole (CVE-2023-28117). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2019-110 An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of tim
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2019-16865). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-172 There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit P
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2019-19911). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-76 Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2020-10177). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-77 In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2020-10378). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-78 In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2020-10379). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-79 In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.
    /workdirs/scan-8ed2ff55-6fb1-4f1d-8b3e-c21e7afcb871/requirements/production.txt
    A package you depend on has a known security hole (CVE-2020-10994). Fix: Update that package to its patched version.
… 76 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrep none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddog none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecard didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.