zanieb/devpi

API keys, passwords or tokens committed into the repo.

• Serious curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.
  doc/curl.rst:29
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.
  doc/curl.rst:46
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.
  doc/curl.rst:71
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.
  doc/curl.rst:78
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.
  doc/curl.rst:95
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.
  doc/curl.rst:118
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.
  doc/curl.rst:139
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.
  doc/curl.rst:195
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Serious curl-auth-user Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.
  doc/curl.rst:203
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  client/testing/test_push.py:326
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  client/testing/test_upload.py:363
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  server/test_devpi_server/importexportdata/badusername/dataindex.json:9
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  server/test_devpi_server/importexportdata/badindexname/dataindex.json:9
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  server/test_devpi_server/importexportdata/basescycle/dataindex.json:9
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  server/test_devpi_server/importexportdata/deletedbase/dataindex.json:9
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  server/test_devpi_server/importexportdata/normalization/dataindex.json:9
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  server/test_devpi_server/importexportdata/toxresult_naming_scheme/dataindex.json:9
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  server/test_devpi_server/importexportdata/removedindexplugin/dataindex.json:57
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  server/test_devpi_server/importexportdata/toxresult_upload_default/dataindex.json:9
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  server/test_devpi_server/importexportdata/normalization_merge/dataindex.json:9
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  server/test_devpi_server/test_importexport.py:617
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  server/test_devpi_server/test_importexport.py:779
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  server/test_devpi_server/test_mirror.py:1214
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

Nothing found by this check. ✓

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OSV-Scanner v1.9.2 · Apache-2.0

error: timeout after 120s

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0