gitsafehub
github.com/jinyangwu/seed ↗

jinyangwu/seed

scanned 2026-07-29 · git 2cf2fad
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 3 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets1Vulnerable dependencies39Known OSS vulnerabilities—Risky code patterns✓Malicious dependencies—Project health—

Security checks

Leaked secrets — Gitleaksⓘ 1 found

API keys, passwords or tokens committed into the repo.

  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    verl/protocol.py:67
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 39 found · 1 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2025-23042 Gradio Blocked Path ACL Bypass Vulnerability
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2025-23042). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-30861 flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2023-30861). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-25577 python-werkzeug: high resource usage when parsing multipart form data with many fields
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2023-25577). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-34069 python-werkzeug: user may execute code on a developer's machine
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2024-34069). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-46136 python-werkzeug: high resource consumption leading to denial of service
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2023-46136). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-49766 werkzeug: python-werkzeug: Werkzeug safe_join not safe on Windows
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2024-49766). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-49767 werkzeug: python-werkzeug: Werkzeug possible resource exhaustion when parsing file data in forms
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2024-49767). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-66221 Werkzeug: Werkzeug: Denial of service via Windows device names in path segments
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2025-66221). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-21860 Werkzeug safe_join() allows Windows special device names with compound extensions
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2026-21860). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-27199 Werkzeug safe_join() allows Windows special device names
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2026-27199). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47084 Gradios's CORS origin validation is not performed when the request has a cookie
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2024-47084). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47867 Gradio lacks integrity checking on the downloaded FRP client
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2024-47867). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47870 Gradio has a race condition in update_root_in_config may redirect user traffic
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2024-47870). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47871 Gradio uses insecure communication between the FRP client and server
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2024-47871). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-4941 Local file inclusion in gradio
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2024-4941). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-28414 Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2026-28414). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-28416 Gradio: Gradio: Server-Side Request Forgery allows access to internal services via malicious Space loading
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2026-28416). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-48545 Gradio contains a cookie injection vulnerability
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2026-48545). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47164 Gradio's `is_in_or_equal` function may be bypassed
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2024-47164). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47165 Gradio's CORS origin validation accepts the null origin
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2024-47165). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47166 Gradio has a one-level read path traversal in `/custom_component`
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2024-47166). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47167 Gradio vulnerable to SSRF in the path parameter of /queue/join
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2024-47167). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47868 Gradio has several components with post-process steps allow arbitrary file leaks
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2024-47868). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47869 Gradio performs a non-constant-time comparison when comparing hashes
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2024-47869). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47872 Gradio has an XSS on every Gradio server via upload of HTML files, JS files, or SVG files
    agent_system/environments/env_package/webshop/webshop/requirements.txt
    A package you depend on has a known security hole (CVE-2024-47872). Fix: Update that package to its patched version.
… 14 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ timed out

Your dependencies cross-checked against the OSV vulnerability database.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OSV-Scanner v1.9.2 · Apache-2.0

error: timeout after 400s

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ timed out

Packages that look intentionally malicious: typosquats, sneaky install scripts.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Guarddog v2.10.0 · Apache-2.0

error: pypi:timeout

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.