Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
jwt-base64 Detected a Base64-encoded JSON Web Token, posing a risk of exposing encoded authentication and data exchange information.Packages you depend on that have known security holes (CVEs).
CVE-2026-69247 cryptography is a package designed to expose cryptographic primitives ...CVE-2026-69249 python-cryptography is a package designed to expose cryptographic prim ...GHSA-537c-gmf6-5ccf Vulnerable OpenSSL included in cryptography wheelsCVE-2026-39892 cryptography: Cryptography: Buffer overflow via non-contiguous buffer in APICVE-2026-69248 cryptography is a package designed to expose cryptographic primitives ...CVE-2026-42544 Granian vulnerable to unauthenticated DoS via WebSocket subprotocol header panicCVE-2026-42545 Granian vulnerable to DoS via WSGI response header panicCVE-2026-45409 python-idna: idna: Denial of Service via specially crafted long inputsCVE-2026-41205 mako: Mako: Information disclosure via path traversal vulnerabilityCVE-2026-44307 mako: Mako: Information disclosure via directory traversalCVE-2025-67221 orjson: orjson: Denial of Service due to unbounded recursion with deeply nested JSON documentsCVE-2026-25990 pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD ImageCVE-2026-40192 Pillow: Pillow: Denial of Service via decompression bomb in FITS image processingCVE-2026-42311 Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processingCVE-2026-54058 Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA imageCVE-2026-54059 python-pillow: Pillow: Denial of Service via crafted PCF font dataCVE-2026-54060 python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font filesCVE-2026-55379 python-pillow: Pillow: Denial of Service via crafted BDF font fileCVE-2026-55380 python-pillow: Pillow: Denial of Service via crafted GD 2.x image fileCVE-2026-59197 Pillow: Pillow: Native heap out-of-bounds writeCVE-2026-59199 Pillow: Pillow: Denial of Service via out-of-bounds write in image processingCVE-2026-59200 Pillow: Pillow: Denial of service via crafted PDF streamCVE-2026-59204 Pillow: Pillow: Denial of Service via crafted JPEG2000 imageCVE-2026-59205 Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply APICVE-2026-42308 Pillow: python: Pillow: Denial of Service via integer overflow in font processingYour dependencies cross-checked against the OSV vulnerability database.
PYSEC-2026-36 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted PythoGHSA-77vg-94rm-hx3p Svelte devalue: DoS via sparse array deserializationGHSA-28wg-ghj8-5hjv nanoid: non-secure generators can loop indefinitely with negative sizeGHSA-2v37-7h3g-55p8 nanoid: custom generators can loop indefinitely when size is zeroGHSA-6g55-p6wh-862q PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS commentsGHSA-fxqj-rqcc-2cmp PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unsetGHSA-qx2v-qp2m-jg93 PostCSS has XSS via Unescaped </style> in its CSS Stringify OutputGHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File DisclosureGHSA-9rmh-mm8f-r9h6 Svelte: ReDoS in `<svelte:element>` Tag ValidationGHSA-f3cj-j4f6-wq85 Svelte: SSR XSS via Insecure Promise Serialization in hydratableGHSA-pr6f-5x2q-rwfp Svelte SSR vulnerable to cross-site scripting via spread attributesGHSA-rcqx-6q8c-2c42 Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework StateGHSA-fx2h-pf6j-xcff vite: `server.fs.deny` bypass on Windows alternate pathsGHSA-v6wh-96g9-6wx3 launch-editor: NTLMv2 hash disclosure via UNC path handling on WindowsPYSEC-2026-2132 Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.PYSEC-2026-35 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certPYSEC-2026-3552 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timingPYSEC-2026-3553 python-cryptography: Duplicate self-signed intermediates can cause exponential path-buildingPYSEC-2026-3554 python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtreesGHSA-537c-gmf6-5ccf Vulnerable OpenSSL included in cryptography wheelsPYSEC-2026-2502 Granian vulnerable to DoS via WSGI response header panicPYSEC-2026-2503 Granian vulnerable to unauthenticated DoS via WebSocket subprotocol header panicPYSEC-2026-215 Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions priorPYSEC-2026-2617 Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookupPYSEC-2026-88 Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is Code that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.