gitsafehub
github.com/ptone/python-docs-samples ↗

ptone/python-docs-samples

scanned 2026-08-11 · git 4d91e3c
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 4 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets13Vulnerable dependencies2816Known OSS vulnerabilities—Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ 13 found · 3 serious

API keys, passwords or tokens committed into the repo.

  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    appengine/standard_python3/pubsub/data/privatekey.pem:1
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    iot/api-client/http_example/resources/rsa_private.pem:1
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    iot/api-client/mqtt_example/resources/rsa_private.pem:1
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    cdn/snippets_test.py:107
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    cdn/snippets_test.py:110
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    functions/billing/main.py:49
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    storage/api/customer_supplied_keys.py:43
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    storage/api/customer_supplied_keys.py:49
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    storage/api/customer_supplied_keys.py:51
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    storage/cloud-client/encryption_test.py:34
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    storage/cloud-client/encryption_test.py:37
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    storage/cloud-client/encryption_test.py:107
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    storage/cloud-client/storage_object_csek_to_cmek.py:28
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 2816 found · 81 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2022-28346 Django: SQL injection in QuerySet.annotate(),aggregate() and extra()
    appengine/flexible/django_cloudsql/requirements.txt
    A package you depend on has a known security hole (CVE-2022-28346). Fix: Update that package to its patched version.
  • Serious CVE-2022-28347 Django: SQL injection via QuerySet.explain(options) on PostgreSQL
    appengine/flexible/django_cloudsql/requirements.txt
    A package you depend on has a known security hole (CVE-2022-28347). Fix: Update that package to its patched version.
  • Serious CVE-2022-34265 python-django: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments
    appengine/flexible/django_cloudsql/requirements.txt
    A package you depend on has a known security hole (CVE-2022-34265). Fix: Update that package to its patched version.
  • Serious CVE-2023-31047 python-django: Potential bypass of validation when uploading multiple files using one form field
    appengine/flexible/django_cloudsql/requirements.txt
    A package you depend on has a known security hole (CVE-2023-31047). Fix: Update that package to its patched version.
  • Serious CVE-2025-64459 django: Django SQL injection
    appengine/flexible/django_cloudsql/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious CVE-2020-7471 django: potential SQL injection via StringAgg(delimiter)
    appengine/flexible/hello_world_django/requirements.txt
    A package you depend on has a known security hole (CVE-2020-7471). Fix: Update that package to its patched version.
  • Serious CVE-2025-64459 django: Django SQL injection
    appengine/flexible/hello_world_django/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious CVE-2020-7471 django: potential SQL injection via StringAgg(delimiter)
    appengine/flexible/hello_world_django/requirements.txt
    A package you depend on has a known security hole (CVE-2020-7471). Fix: Update that package to its patched version.
  • Serious CVE-2022-28346 Django: SQL injection in QuerySet.annotate(),aggregate() and extra()
    appengine/flexible/hello_world_django/requirements.txt
    A package you depend on has a known security hole (CVE-2022-28346). Fix: Update that package to its patched version.
  • Serious CVE-2022-28347 Django: SQL injection via QuerySet.explain(options) on PostgreSQL
    appengine/flexible/hello_world_django/requirements.txt
    A package you depend on has a known security hole (CVE-2022-28347). Fix: Update that package to its patched version.
  • Serious CVE-2025-64459 django: Django SQL injection
    appengine/flexible/hello_world_django/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious CVE-2020-7471 django: potential SQL injection via StringAgg(delimiter)
    appengine/flexible/hello_world_django/requirements.txt
    A package you depend on has a known security hole (CVE-2020-7471). Fix: Update that package to its patched version.
  • Serious CVE-2021-35042 django: potential SQL injection via unsanitized QuerySet.order_by() input
    appengine/flexible/hello_world_django/requirements.txt
    A package you depend on has a known security hole (CVE-2021-35042). Fix: Update that package to its patched version.
  • Serious CVE-2025-64459 django: Django SQL injection
    appengine/flexible/hello_world_django/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious CVE-2022-22817 python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions
    appengine/flexible/scipy/requirements.txt
    A package you depend on has a known security hole (CVE-2022-22817). Fix: Update that package to its patched version.
  • Serious CVE-2023-50447 pillow: Arbitrary Code Execution via the environment parameter
    appengine/flexible/scipy/requirements.txt
    A package you depend on has a known security hole (CVE-2023-50447). Fix: Update that package to its patched version.
  • Serious CVE-2025-64459 django: Django SQL injection
    appengine/standard/django/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious CVE-2024-36039 python-pymysql: SQL injection if used with untrusted JSON input
    appengine/standard/django/requirements.txt
    A package you depend on has a known security hole (CVE-2024-36039). Fix: Update that package to its patched version.
  • Serious CVE-2024-36039 python-pymysql: SQL injection if used with untrusted JSON input
    appengine/standard_python3/cloudsql/requirements.txt
    A package you depend on has a known security hole (CVE-2024-36039). Fix: Update that package to its patched version.
  • Serious CVE-2022-28346 Django: SQL injection in QuerySet.annotate(),aggregate() and extra()
    appengine/standard_python3/django/requirements.txt
    A package you depend on has a known security hole (CVE-2022-28346). Fix: Update that package to its patched version.
  • Serious CVE-2022-28347 Django: SQL injection via QuerySet.explain(options) on PostgreSQL
    appengine/standard_python3/django/requirements.txt
    A package you depend on has a known security hole (CVE-2022-28347). Fix: Update that package to its patched version.
  • Serious CVE-2022-34265 python-django: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments
    appengine/standard_python3/django/requirements.txt
    A package you depend on has a known security hole (CVE-2022-34265). Fix: Update that package to its patched version.
  • Serious CVE-2023-31047 python-django: Potential bypass of validation when uploading multiple files using one form field
    appengine/standard_python3/django/requirements.txt
    A package you depend on has a known security hole (CVE-2023-31047). Fix: Update that package to its patched version.
  • Serious CVE-2025-64459 django: Django SQL injection
    appengine/standard_python3/django/requirements.txt
    A package you depend on has a known security hole (CVE-2025-64459). Fix: Update that package to its patched version.
  • Serious CVE-2023-47248 PyArrow: Arbitrary code execution when loading a malicious data file
    bigquery/bqml/requirements.txt
    A package you depend on has a known security hole (CVE-2023-47248). Fix: Update that package to its patched version.
… 2791 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ timed out

Your dependencies cross-checked against the OSV vulnerability database.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OSV-Scanner v1.9.2 · Apache-2.0

error: timeout after 120s

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.