gitsafehub
github.com/johannhof/tracking-protection-issues ↗

johannhof/tracking-protection-issues

scanned 2026-08-16 · git e603f71
2 of 6 checks flagged a security issue
🟡 Worth a look
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets—Vulnerable dependencies36Known OSS vulnerabilities40Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ timed out

API keys, passwords or tokens committed into the repo.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via Gitleaks v8.21.2 · MIT

error: timeout after 120s

Vulnerable dependencies — Trivyⓘ 36 found

Packages you depend on that have known security holes (CVEs).

  • Worth fixing CVE-2023-37920 python-certifi: Removal of e-Tugra root certificate
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-37920). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-23491 python-certifi: untrusted root certificates
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2022-23491). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-30861 flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-30861). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-1135 python-gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding headers
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-1135). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-6827 gunicorn: HTTP Request Smuggling in benoitc/gunicorn
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-6827). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-3651 python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode()
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-3651). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-45409 python-idna: idna: Denial of Service via specially crafted long inputs
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-28493 python-jinja2: ReDoS vulnerability in the urlize filter
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2020-28493). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-22195 jinja2: HTML attribute injection when passing user input as keys to xmlattr filter
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-22195). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-34064 jinja2: accepts keys containing non-attribute characters
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-34064). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-56326 jinja2: Jinja has a sandbox breakout through indirect reference to format method
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-27516 jinja2: Jinja sandbox breakout through attr filter selecting format method
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-28684 python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-28684). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-32681 python-requests: Unintended leak of Proxy-Authorization header
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-32681). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-35195 requests: subsequent requests to the same host ignore cert verification
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-35195). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47081 requests: Requests vulnerable to .netrc credentials leak via malicious URLs
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-47081). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-25645 requests: Requests: Security bypass due to predictable temporary file creation
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-25645). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-43804 python-urllib3: Cookie request header isn't stripped during cross-origin redirects
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-43804). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-66418 urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2025-66418). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-66471 urllib3: urllib3 Streaming API improperly handles highly compressed data
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2025-66471). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-21441 urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-21441). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-44431 urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-44431). Fix: Update that package to its patched version.
  • Worth fixing CVE-2019-11236 python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2019-11236). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-26137 python-urllib3: CRLF injection via HTTP request method
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2020-26137). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-45803 urllib3: Request body not stripped after redirect from 303 status changes request method to GET
    Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-45803). Fix: Update that package to its patched version.
… 11 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 40 found

Your dependencies cross-checked against the OSV vulnerability database.

  • Worth fixing PYSEC-2022-42986 Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2022-23491). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-135 Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. These are in the process of being removed from Mozilla's trust store. e-Tugra's root certificates are being removed pur
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-37920). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2024-230 Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-39689). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2132 Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-7246). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-62 Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-30861). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2151 Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Us
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-27205). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1433 Gunicorn HTTP Request/Response Smuggling vulnerability
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-6827). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1434 Request smuggling leading to endpoint restriction bypass in Gunicorn
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-1135). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2024-60 A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings,
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-3651). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-215 Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-66 This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2020-28493). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1471 Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1473 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-22195). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1474 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-34064). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1475 Jinja has a sandbox breakout through indirect reference to format method
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2270 python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewrit
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-28684). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-74 Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `re
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-32681). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1872 Requests vulnerable to .netrc credentials leak via malicious URLs
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-47081). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1873 Requests `Session` object does not verify requests after making first request with verify=False
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2024-35195). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2275 Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system te
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-25645). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2019-132 In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2019-11236). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-148 urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: thi
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2020-26137). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-192 urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of t
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-43804). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-212 urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had i
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2023-45803). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-141 urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=Fal
    /workdirs/scan-4728e056-8a4e-4dcb-995f-2b6252c50b64/Pipfile.lock
    A package you depend on has a known security hole (CVE-2026-44431). Fix: Update that package to its patched version.
… 15 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.