gitsafehub
github.com/josemoreville/guyamoe ↗

josemoreville/guyamoe

scanned 2026-08-14 · git bdc19aa
4 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets1Vulnerable dependencies104Known OSS vulnerabilities173Risky code patternsMalicious dependencies1Project health

Security checks

Leaked secrets — Gitleaks 1 found

API keys, passwords or tokens committed into the repo.

  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    reader/models.py:61
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivy 104 found · 5 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2021-35042 django: potential SQL injection via unsanitized QuerySet.order_by() input
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-35042). Fix: Update that package to its patched version.
  • Serious CVE-2025-64459 django: Django SQL injection
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious CVE-2021-34552 python-pillow: Buffer overflow in image convert function
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-34552). Fix: Update that package to its patched version.
  • Serious CVE-2022-22817 python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions
    requirements.txt
    A package you depend on has a known security hole (CVE-2022-22817). Fix: Update that package to its patched version.
  • Serious CVE-2023-50447 pillow: Arbitrary Code Execution via the environment parameter
    requirements.txt
    A package you depend on has a known security hole (CVE-2023-50447). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-31542 django: Potential directory-traversal via uploaded files
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-31542). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-33571 django: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-33571). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-36359 An issue was discovered in the HTTP FileResponse class in Django 3.2 b ...
    requirements.txt
    A package you depend on has a known security hole (CVE-2022-36359). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-57833 django: Django SQL injection in FilteredRelation column aliases
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-57833). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-64458 Django: Denial-of-service vulnerability in Django on Windows
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-64458). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-28658 django: potential directory-traversal via uploaded files
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-28658). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-32052 django: header injection possibility since URLValidator accepted newlines in input on Python 3.9.5+
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-32052). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-33203 django: Potential directory traversal via ``admindocs``
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-33203). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-44420 django: potential bypass of an upstream access control based on URL paths
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-44420). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-45231 python-django: Potential user email enumeration via response status on password reset
    requirements.txt
    A package you depend on has a known security hole (CVE-2024-45231). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-48432 django: Django Path Injection Vulnerability
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-48432). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53877 django: Django: Information disclosure via heap buffer over-read in GDALRaster
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-53877). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-53878 django: Django: HTTP header injection via DomainNameValidator accepting newlines
    requirements.txt
    A package you depend on has a known security hole (CVE-2026-53878). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-69534 python-markdown: denial of service via malformed HTML-like sequences
    requirements.txt
    A package you depend on has a known security hole (CVE-2025-69534). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-23437 python-pillow: possible ReDoS via the getrgb function
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-23437). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-25287 python-pillow: Out-of-bounds read in J2K image reader
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-25287). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-25288 python-pillow: Out-of-bounds read in J2K image reader
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-25288). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-25291 python-pillow: out-of-bounds read in TiffReadRGBATile in TiffDecode.c
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-25291). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-27921 python-pillow: Excessive memory allocation in BLP image reader
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-27921). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-27922 python-pillow: Excessive memory allocation in ICNS image reader
    requirements.txt
    A package you depend on has a known security hole (CVE-2021-27922). Fix: Update that package to its patched version.
… 79 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scanner 173 found · 17 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2021-109 Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2021-35042). Fix: Update that package to its patched version.
  • Serious GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-137 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2021-25287). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-138 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2021-25288). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-331 Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2021-34552). Fix: Update that package to its patched version.
  • Serious PYSEC-2022-10 PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2022-22817). Fix: Update that package to its patched version.
  • Serious PYSEC-2022-168 Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2022-24303). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-457 Arbitrary Code Execution in Pillow
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2023-50447). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-2102 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in resp
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2026-34520). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-109 Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2021-35042). Fix: Update that package to its patched version.
  • Serious GHSA-frmv-pr5f-9mcr Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-137 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2021-25287). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-138 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2021-25288). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-331 Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2021-34552). Fix: Update that package to its patched version.
  • Serious PYSEC-2022-10 PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2022-22817). Fix: Update that package to its patched version.
  • Serious PYSEC-2022-168 Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2022-24303). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-457 Arbitrary Code Execution in Pillow
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2023-50447). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-439 In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2021-44420). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-6 In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2021-28658). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-7 In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2021-31542). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-8 In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2021-32052). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-98 Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the exist
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2021-33203). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2021-99 In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This ma
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2021-33571). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1297 Django allows enumeration of user e-mail addresses
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2024-45231). Fix: Update that package to its patched version.
  • Worth fixing GHSA-6w2r-r2m5-xq5w Django is subject to SQL injection through its column aliases
    /workdirs/scan-ef928599-2fea-4d99-823e-466d6fff1ed5/requirements.txt
    A package you depend on has a known security hole (CVE-2025-57833). Fix: Update that package to its patched version.
… 148 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrep none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddog 1 found

Packages that look intentionally malicious: typosquats, sneaky install scripts.

  • Worth fixing guarddog-pypi-shady-links shady-links match in discord.py 1.6.0
    discord.py
    A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecard didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.