yikun/envoy

API keys, passwords or tokens committed into the repo.

• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/config/integration/certs/client_ecdsakey.pem:4
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/config/integration/certs/cakey.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/config/integration/certs/server_ecdsakey.pem:4
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/config/integration/certs/clientkey.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/config/integration/certs/serverkey.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/config/integration/certs/upstreamcakey.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/config/integration/certs/upstreamkey.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/extensions/filters/http/jwt_authn/test_common.h:9
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/extensions/transport_sockets/tls/test_data/ca_key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/extensions/transport_sockets/tls/test_data/expired_key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/extensions/transport_sockets/tls/test_data/expired_san_uri_key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/extensions/transport_sockets/tls/test_data/fake_ca_key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/extensions/transport_sockets/tls/test_data/no_san_key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/extensions/transport_sockets/tls/test_data/password_protected_key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/extensions/transport_sockets/tls/test_data/san_dns3_key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/extensions/transport_sockets/tls/test_data/san_dns2_key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/extensions/transport_sockets/tls/test_data/intermediate_ca_key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/extensions/transport_sockets/tls/test_data/san_only_dns_key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/extensions/transport_sockets/tls/test_data/selfsigned_ecdsa_p256_key.pem:4
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/extensions/transport_sockets/tls/test_data/selfsigned_ecdsa_p384_key.pem:4
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/extensions/transport_sockets/tls/test_data/selfsigned_rsa_1024_key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/extensions/transport_sockets/tls/test_data/san_dns_key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/extensions/transport_sockets/tls/test_data/selfsigned_key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/extensions/transport_sockets/tls/test_data/san_multiple_dns_key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious private-key Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
  test/extensions/transport_sockets/tls/test_data/selfsigned_rsa_3072_key.pem:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2022-24439 GitPython: improper user input validation leads into a RCE
  docs/requirements.txt
  A package you depend on has a known security hole (CVE-2022-24439). Fix: Update that package to its patched version.
• Serious CVE-2023-40267 GitPython: Insecure non-multi options in clone and clone_from is not blocked
  docs/requirements.txt
  A package you depend on has a known security hole (CVE-2023-40267). Fix: Update that package to its patched version.
• Serious CVE-2022-24439 GitPython: improper user input validation leads into a RCE
  tools/deprecate_features/requirements.txt
  A package you depend on has a known security hole (CVE-2022-24439). Fix: Update that package to its patched version.
• Serious CVE-2023-40267 GitPython: Insecure non-multi options in clone and clone_from is not blocked
  tools/deprecate_features/requirements.txt
  A package you depend on has a known security hole (CVE-2023-40267). Fix: Update that package to its patched version.
• Serious CVE-2022-24439 GitPython: improper user input validation leads into a RCE
  tools/deprecate_version/requirements.txt
  A package you depend on has a known security hole (CVE-2022-24439). Fix: Update that package to its patched version.
• Serious CVE-2023-40267 GitPython: Insecure non-multi options in clone and clone_from is not blocked
  tools/deprecate_version/requirements.txt
  A package you depend on has a known security hole (CVE-2023-40267). Fix: Update that package to its patched version.
• Worth fixing CVE-2019-10906 python-jinja2: str.format_map allows sandbox escape
  configs/requirements.txt
  A package you depend on has a known security hole (CVE-2019-10906). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-28493 python-jinja2: ReDoS vulnerability in the urlize filter
  configs/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28493). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-22195 jinja2: HTML attribute injection when passing user input as keys to xmlattr filter
  configs/requirements.txt
  A package you depend on has a known security hole (CVE-2024-22195). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-34064 jinja2: accepts keys containing non-attribute characters
  configs/requirements.txt
  A package you depend on has a known security hole (CVE-2024-34064). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-56326 jinja2: Jinja has a sandbox breakout through indirect reference to format method
  configs/requirements.txt
  A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-27516 jinja2: Jinja sandbox breakout through attr filter selecting format method
  configs/requirements.txt
  A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
• Worth fixing CVE-2023-40590 gitpython: improper executable lookup on windows
  docs/requirements.txt
  A package you depend on has a known security hole (CVE-2023-40590). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-22190 Untrusted search path under some conditions on Windows allows arbitrary code execution
  docs/requirements.txt
  A package you depend on has a known security hole (CVE-2024-22190). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-42284 GitPython is a python library used to interact with Git repositories. ...
  docs/requirements.txt
  A package you depend on has a known security hole (CVE-2026-42284). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44243 GitPython: GitPython: Arbitrary file write via crafted reference paths
  docs/requirements.txt
  A package you depend on has a known security hole (CVE-2026-44243). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44244 GitPython is a python library used to interact with Git repositories. ...
  docs/requirements.txt
  A package you depend on has a known security hole (CVE-2026-44244). Fix: Update that package to its patched version.
• Worth fixing GHSA-2f96-g7mh-g2hx GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
  docs/requirements.txt
  A package you depend on has a known security hole (GHSA-2f96-g7mh-g2hx). Fix: Update that package to its patched version.
• Worth fixing GHSA-3f7w-8rr8-f37f GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read
  docs/requirements.txt
  A package you depend on has a known security hole (GHSA-3f7w-8rr8-f37f). Fix: Update that package to its patched version.
• Worth fixing GHSA-3rp5-jjmw-4wv2 GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
  docs/requirements.txt
  A package you depend on has a known security hole (GHSA-3rp5-jjmw-4wv2). Fix: Update that package to its patched version.
• Worth fixing GHSA-4gmw-gg2m-w46p GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite
  docs/requirements.txt
  A package you depend on has a known security hole (GHSA-4gmw-gg2m-w46p). Fix: Update that package to its patched version.
• Worth fixing GHSA-6p8h-3wgx-97gf GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
  docs/requirements.txt
  A package you depend on has a known security hole (GHSA-6p8h-3wgx-97gf). Fix: Update that package to its patched version.
• Worth fixing GHSA-94p4-4cq8-9g67 GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
  docs/requirements.txt
  A package you depend on has a known security hole (GHSA-94p4-4cq8-9g67). Fix: Update that package to its patched version.
• Worth fixing GHSA-956x-8gvw-wg5v GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`
  docs/requirements.txt
  A package you depend on has a known security hole (GHSA-956x-8gvw-wg5v). Fix: Update that package to its patched version.
• Worth fixing GHSA-9rj7-rf2p-w77r GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks
  docs/requirements.txt
  A package you depend on has a known security hole (GHSA-9rj7-rf2p-w77r). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious PYSEC-2022-42992 All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/docs/requirements.txt
  A package you depend on has a known security hole (CVE-2022-24439). Fix: Update that package to its patched version.
• Serious PYSEC-2023-137 GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/docs/requirements.txt
  A package you depend on has a known security hole (CVE-2023-40267). Fix: Update that package to its patched version.
• Serious PYSEC-2026-2161 GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options))
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/docs/requirements.txt
  A package you depend on has a known security hole (CVE-2026-42284). Fix: Update that package to its patched version.
• Serious PYSEC-2022-42992 All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/docs/requirements.txt
  A package you depend on has a known security hole (CVE-2022-24439). Fix: Update that package to its patched version.
• Serious PYSEC-2023-137 GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/docs/requirements.txt
  A package you depend on has a known security hole (CVE-2023-40267). Fix: Update that package to its patched version.
• Serious PYSEC-2026-2161 GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options))
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/docs/requirements.txt
  A package you depend on has a known security hole (CVE-2026-42284). Fix: Update that package to its patched version.
• Serious PYSEC-2022-42992 All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/tools/deprecate_features/requirements.txt
  A package you depend on has a known security hole (CVE-2022-24439). Fix: Update that package to its patched version.
• Serious PYSEC-2023-137 GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/tools/deprecate_features/requirements.txt
  A package you depend on has a known security hole (CVE-2023-40267). Fix: Update that package to its patched version.
• Serious PYSEC-2026-2161 GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options))
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/tools/deprecate_features/requirements.txt
  A package you depend on has a known security hole (CVE-2026-42284). Fix: Update that package to its patched version.
• Serious PYSEC-2022-42992 All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/tools/deprecate_features/requirements.txt
  A package you depend on has a known security hole (CVE-2022-24439). Fix: Update that package to its patched version.
• Serious PYSEC-2023-137 GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/tools/deprecate_features/requirements.txt
  A package you depend on has a known security hole (CVE-2023-40267). Fix: Update that package to its patched version.
• Serious PYSEC-2026-2161 GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options))
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/tools/deprecate_features/requirements.txt
  A package you depend on has a known security hole (CVE-2026-42284). Fix: Update that package to its patched version.
• Serious PYSEC-2022-42992 All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/tools/deprecate_version/requirements.txt
  A package you depend on has a known security hole (CVE-2022-24439). Fix: Update that package to its patched version.
• Serious PYSEC-2023-137 GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/tools/deprecate_version/requirements.txt
  A package you depend on has a known security hole (CVE-2023-40267). Fix: Update that package to its patched version.
• Serious PYSEC-2026-2161 GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options))
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/tools/deprecate_version/requirements.txt
  A package you depend on has a known security hole (CVE-2026-42284). Fix: Update that package to its patched version.
• Serious PYSEC-2022-42992 All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/tools/deprecate_version/requirements.txt
  A package you depend on has a known security hole (CVE-2022-24439). Fix: Update that package to its patched version.
• Serious PYSEC-2023-137 GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/tools/deprecate_version/requirements.txt
  A package you depend on has a known security hole (CVE-2023-40267). Fix: Update that package to its patched version.
• Serious PYSEC-2026-2161 GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options))
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/tools/deprecate_version/requirements.txt
  A package you depend on has a known security hole (CVE-2026-42284). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2019-217 In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/configs/requirements.txt
  A package you depend on has a known security hole (CVE-2019-10906). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2021-66 This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/configs/requirements.txt
  A package you depend on has a known security hole (CVE-2020-28493). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1471 Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/configs/requirements.txt
  A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1473 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/configs/requirements.txt
  A package you depend on has a known security hole (CVE-2024-22195). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1474 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/configs/requirements.txt
  A package you depend on has a known security hole (CVE-2024-34064). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1475 Jinja has a sandbox breakout through indirect reference to format method
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/configs/requirements.txt
  A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2023-161 GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython d
  /workdirs/scan-b0f51085-f82d-41a0-b134-d25e870c542f/docs/requirements.txt
  A package you depend on has a known security hole (CVE-2023-40590). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0