gitsafehub
github.com/ranshid/s2n-tls ↗

ranshid/s2n-tls

scanned 2026-08-08 · git 0a17e62
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets192Vulnerable dependencies✓Known OSS vulnerabilities18Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ 192 found · 70 serious

API keys, passwords or tokens committed into the repo.

  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/benchmark/utils/shared_info.cc:57
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/benchmark/utils/shared_info.cc:108
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/unit/kats/generate_pq_hybrid_tls13_handshake_kats.py:7
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/unit/kats/generate_pq_hybrid_tls13_handshake_kats.py:11
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/unit/kats/generate_pq_hybrid_tls13_handshake_kats.py:18
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/unit/kats/generate_pq_hybrid_tls13_handshake_kats.py:27
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    bin/s2nd.c:108
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/fuzz/s2n_client_fuzz_test.c:97
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/fuzz/s2n_memory_leak_negative_test.c:96
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/fuzz/s2n_server_fuzz_test.c:100
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/fuzz/s2n_client_cert_verify_recv_test.c:93
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/pems/ecdsa_p256_pkcs1_key.pem:4
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/pems/ecdsa_p384_pkcs1_key.pem:4
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/pems/localhost_ecdsa_p256_key.pem:4
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/pems/localhost_rsa_pss_2048_sha256_key.pem:1
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/pems/ocsp/server_ecdsa_key.pem:4
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/pems/ocsp/ca_key.pem:1
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/pems/rsa_1024_sha1_client_key.pem:1
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/pems/rsa_1024_sha224_client_key.pem:1
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/pems/quail_cn_rattlesnake_cn_rsa_key.pem:1
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/pems/ocsp/ocsp_key.pem:1
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/pems/rsa_1024_sha256_client_key.pem:1
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/pems/rsa_1024_sha512_client_key.pem:1
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/pems/rsa_2048_invalid_trailer_key.pem:1
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    tests/pems/rsa_1024_sha384_client_key.pem:1
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
… 167 more not shown

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ none found ✓

Packages you depend on that have known security holes (CVEs).

Nothing found by this check. ✓

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 18 found

Your dependencies cross-checked against the OSV vulnerability database.

  • Worth fixing PYSEC-2021-108 An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking,
    /workdirs/scan-b70ddc8b-bf13-4dbc-8869-beade549e06c/.github/gha_monitor/requirements.txt
    A package you depend on has a known security hole (CVE-2021-33503). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-192 urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of t
    /workdirs/scan-b70ddc8b-bf13-4dbc-8869-beade549e06c/.github/gha_monitor/requirements.txt
    A package you depend on has a known security hole (CVE-2023-43804). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-212 urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had i
    /workdirs/scan-b70ddc8b-bf13-4dbc-8869-beade549e06c/.github/gha_monitor/requirements.txt
    A package you depend on has a known security hole (CVE-2023-45803). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-141 urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=Fal
    /workdirs/scan-b70ddc8b-bf13-4dbc-8869-beade549e06c/.github/gha_monitor/requirements.txt
    A package you depend on has a known security hole (CVE-2026-44431). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1994 urllib3 streaming API improperly handles highly compressed data
    /workdirs/scan-b70ddc8b-bf13-4dbc-8869-beade549e06c/.github/gha_monitor/requirements.txt
    A package you depend on has a known security hole (CVE-2025-66471). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1995 urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
    /workdirs/scan-b70ddc8b-bf13-4dbc-8869-beade549e06c/.github/gha_monitor/requirements.txt
    A package you depend on has a known security hole (CVE-2024-37891). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1996 Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
    /workdirs/scan-b70ddc8b-bf13-4dbc-8869-beade549e06c/.github/gha_monitor/requirements.txt
    A package you depend on has a known security hole (CVE-2026-21441). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1998 urllib3 allows an unbounded number of links in the decompression chain
    /workdirs/scan-b70ddc8b-bf13-4dbc-8869-beade549e06c/.github/gha_monitor/requirements.txt
    A package you depend on has a known security hole (CVE-2025-66418). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1999 urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
    /workdirs/scan-b70ddc8b-bf13-4dbc-8869-beade549e06c/.github/gha_monitor/requirements.txt
    A package you depend on has a known security hole (CVE-2025-50181). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-148 urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: thi
    /workdirs/scan-b70ddc8b-bf13-4dbc-8869-beade549e06c/codebuild/requirements.txt
    A package you depend on has a known security hole (CVE-2020-26137). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-192 urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of t
    /workdirs/scan-b70ddc8b-bf13-4dbc-8869-beade549e06c/codebuild/requirements.txt
    A package you depend on has a known security hole (CVE-2023-43804). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-212 urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had i
    /workdirs/scan-b70ddc8b-bf13-4dbc-8869-beade549e06c/codebuild/requirements.txt
    A package you depend on has a known security hole (CVE-2023-45803). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-141 urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=Fal
    /workdirs/scan-b70ddc8b-bf13-4dbc-8869-beade549e06c/codebuild/requirements.txt
    A package you depend on has a known security hole (CVE-2026-44431). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1994 urllib3 streaming API improperly handles highly compressed data
    /workdirs/scan-b70ddc8b-bf13-4dbc-8869-beade549e06c/codebuild/requirements.txt
    A package you depend on has a known security hole (CVE-2025-66471). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1995 urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
    /workdirs/scan-b70ddc8b-bf13-4dbc-8869-beade549e06c/codebuild/requirements.txt
    A package you depend on has a known security hole (CVE-2024-37891). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1996 Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
    /workdirs/scan-b70ddc8b-bf13-4dbc-8869-beade549e06c/codebuild/requirements.txt
    A package you depend on has a known security hole (CVE-2026-21441). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1998 urllib3 allows an unbounded number of links in the decompression chain
    /workdirs/scan-b70ddc8b-bf13-4dbc-8869-beade549e06c/codebuild/requirements.txt
    A package you depend on has a known security hole (CVE-2025-66418). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1999 urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
    /workdirs/scan-b70ddc8b-bf13-4dbc-8869-beade549e06c/codebuild/requirements.txt
    A package you depend on has a known security hole (CVE-2025-50181). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.