gitsafehub
github.com/warner/browserid-tests ↗

warner/browserid-tests

scanned 2026-08-12 · git 3cfeb61
2 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets✓Vulnerable dependencies20Known OSS vulnerabilities44Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ none found ✓

API keys, passwords or tokens committed into the repo.

Nothing found by this check. ✓

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 20 found · 4 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2017-18342 PyYAML: yaml.load() API could execute arbitrary code
    123done/requirements.txt
    A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
  • Serious CVE-2020-14343 PyYAML: incomplete fix for CVE-2020-1747
    123done/requirements.txt
    A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
  • Serious CVE-2017-18342 PyYAML: yaml.load() API could execute arbitrary code
    myfavoritebeer/requirements.txt
    A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
  • Serious CVE-2020-14343 PyYAML: incomplete fix for CVE-2020-1747
    myfavoritebeer/requirements.txt
    A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-29651 python-py: ReDoS in the py.path.svnwc component via mailicious input to blame functionality
    123done/requirements.txt
    A package you depend on has a known security hole (CVE-2020-29651). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-71176 pytest: pytest: Denial of Service or Privilege Escalation via insecure temporary directory handling
    123done/requirements.txt
    A package you depend on has a known security hole (CVE-2025-71176). Fix: Update that package to its patched version.
  • Worth fixing CVE-2018-18074 python-requests: Redirect from HTTPS to HTTP does not remove Authorization header
    123done/requirements.txt
    A package you depend on has a known security hole (CVE-2018-18074). Fix: Update that package to its patched version.
  • Worth fixing CVE-2014-1829 python-requests: redirect can expose netrc password
    123done/requirements.txt
    A package you depend on has a known security hole (CVE-2014-1829). Fix: Update that package to its patched version.
  • Worth fixing CVE-2014-1830 python-requests: Proxy-Authorization header leak
    123done/requirements.txt
    A package you depend on has a known security hole (CVE-2014-1830). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-35195 requests: subsequent requests to the same host ignore cert verification
    123done/requirements.txt
    A package you depend on has a known security hole (CVE-2024-35195). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47081 requests: Requests vulnerable to .netrc credentials leak via malicious URLs
    123done/requirements.txt
    A package you depend on has a known security hole (CVE-2024-47081). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-25645 requests: Requests: Security bypass due to predictable temporary file creation
    123done/requirements.txt
    A package you depend on has a known security hole (CVE-2026-25645). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-29651 python-py: ReDoS in the py.path.svnwc component via mailicious input to blame functionality
    myfavoritebeer/requirements.txt
    A package you depend on has a known security hole (CVE-2020-29651). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-71176 pytest: pytest: Denial of Service or Privilege Escalation via insecure temporary directory handling
    myfavoritebeer/requirements.txt
    A package you depend on has a known security hole (CVE-2025-71176). Fix: Update that package to its patched version.
  • Worth fixing CVE-2018-18074 python-requests: Redirect from HTTPS to HTTP does not remove Authorization header
    myfavoritebeer/requirements.txt
    A package you depend on has a known security hole (CVE-2018-18074). Fix: Update that package to its patched version.
  • Worth fixing CVE-2014-1829 python-requests: redirect can expose netrc password
    myfavoritebeer/requirements.txt
    A package you depend on has a known security hole (CVE-2014-1829). Fix: Update that package to its patched version.
  • Worth fixing CVE-2014-1830 python-requests: Proxy-Authorization header leak
    myfavoritebeer/requirements.txt
    A package you depend on has a known security hole (CVE-2014-1830). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-35195 requests: subsequent requests to the same host ignore cert verification
    myfavoritebeer/requirements.txt
    A package you depend on has a known security hole (CVE-2024-35195). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47081 requests: Requests vulnerable to .netrc credentials leak via malicious URLs
    myfavoritebeer/requirements.txt
    A package you depend on has a known security hole (CVE-2024-47081). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-25645 requests: Requests: Security bypass due to predictable temporary file creation
    myfavoritebeer/requirements.txt
    A package you depend on has a known security hole (CVE-2026-25645). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 44 found · 8 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious PYSEC-2018-49 In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced fo
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-142 A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
  • Serious PYSEC-2018-49 In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced fo
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-142 A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
  • Serious PYSEC-2018-49 In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced fo
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/myfavoritebeer/requirements.txt
    A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-142 A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/myfavoritebeer/requirements.txt
    A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
  • Serious PYSEC-2018-49 In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced fo
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/myfavoritebeer/requirements.txt
    A package you depend on has a known security hole (CVE-2017-18342). Fix: Update that package to its patched version.
  • Serious PYSEC-2021-142 A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/myfavoritebeer/requirements.txt
    A package you depend on has a known security hole (CVE-2020-14343). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2020-92 A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying m
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2020-29651). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1845 pytest has vulnerable tmpdir handling
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2025-71176). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2014-13 Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2014-1829). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2014-14 Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request.
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2014-1830). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2018-28 The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to dis
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2018-18074). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1872 Requests vulnerable to .netrc credentials leak via malicious URLs
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2024-47081). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1873 Requests `Session` object does not verify requests after making first request with verify=False
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2024-35195). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-2275 Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system te
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2026-25645). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-206 NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.0.
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2023-5590). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-215 Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2026-45409). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-192 urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of t
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2023-43804). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2023-212 urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had i
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2023-45803). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-141 urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=Fal
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2026-44431). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1994 urllib3 streaming API improperly handles highly compressed data
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2025-66471). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1995 urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2024-37891). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1996 Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2026-21441). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1998 urllib3 allows an unbounded number of links in the decompression chain
    /workdirs/scan-8cb16481-6f6b-425e-810d-bedcab68f4cb/123done/requirements.txt
    A package you depend on has a known security hole (CVE-2025-66418). Fix: Update that package to its patched version.
… 19 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.