zhisheng17/flink-learning

scanned 2026-06-28 · git d731cee

2 of 6 checks flagged a security issue

🔴 Needs attention

Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets14Vulnerable dependencies1209Known OSS vulnerabilities—Risky code patterns✓Malicious dependencies✓Project health8

Security checks

Leaked secrets — Gitleaksⓘ 14 found

API keys, passwords or tokens committed into the repo.

Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

flink-learning-sql/flink-learning-sql-client/src/main/java/com/zhisheng/sql/utils/HttpClient.java:20

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

flink-learning-basic/flink-learning-data-sources/src/main/resources/rule.sql:41

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

flink-learning-basic/flink-learning-data-sources/src/main/resources/rule.sql:42

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

flink-learning-examples/src/main/resources/alarm-notify.sql:42

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

flink-learning-examples/src/main/resources/alarm-notify.sql:43

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

flink-learning-examples/src/main/resources/alarm-notify.sql:44

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

flink-learning-monitor/flink-learning-monitor-alert/src/test/java/DingDingMsgTest.java:24

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

flink-learning-monitor/flink-learning-monitor-alert/src/test/java/DingDingMsgTest.java:31

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

flink-learning-monitor/flink-learning-monitor-alert/src/test/java/DingDingMsgTest.java:38

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

flink-learning-monitor/flink-learning-monitor-alert/src/test/java/DingDingMsgTest.java:47

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

flink-learning-monitor/flink-learning-monitor-alert/src/test/java/DingDingMsgTest.java:51

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

flink-learning-monitor/flink-learning-monitor-alert/src/test/java/DingDingMsgTest.java:52

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

flink-learning-monitor/flink-learning-monitor-alert/src/test/java/DingDingMsgTest.java:53

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

flink-learning-monitor/flink-learning-monitor-alert/src/test/java/DingDingMsgTest.java:54

A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 1209 found · 11 serious

Packages you depend on that have known security holes (CVEs).

Serious CVE-2019-16942 jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.*

flink-learning-configuration-center/pom.xml

A package you depend on has a known security hole (CVE-2019-16942). Fix: Update that package to its patched version.
Serious CVE-2019-16943 jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource

flink-learning-configuration-center/pom.xml

A package you depend on has a known security hole (CVE-2019-16943). Fix: Update that package to its patched version.
Serious CVE-2019-17531 jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*

flink-learning-configuration-center/pom.xml

A package you depend on has a known security hole (CVE-2019-17531). Fix: Update that package to its patched version.
Serious CVE-2019-20330 jackson-databind: lacks certain net.sf.ehcache blocking

flink-learning-configuration-center/pom.xml

A package you depend on has a known security hole (CVE-2019-20330). Fix: Update that package to its patched version.
Serious CVE-2020-8840 jackson-databind: Lacks certain xbean-reflect/JNDI blocking

flink-learning-configuration-center/pom.xml

A package you depend on has a known security hole (CVE-2020-8840). Fix: Update that package to its patched version.
Serious CVE-2020-9546 jackson-databind: Serialization gadgets in shaded-hikari-config

flink-learning-configuration-center/pom.xml

A package you depend on has a known security hole (CVE-2020-9546). Fix: Update that package to its patched version.
Serious CVE-2020-9547 jackson-databind: Serialization gadgets in ibatis-sqlmap

flink-learning-configuration-center/pom.xml

A package you depend on has a known security hole (CVE-2020-9547). Fix: Update that package to its patched version.
Serious CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core

flink-learning-configuration-center/pom.xml

A package you depend on has a known security hole (CVE-2020-9548). Fix: Update that package to its patched version.
Serious CVE-2024-1597 pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE

flink-learning-sql/flink-learning-sql-blink/pom.xml

A package you depend on has a known security hole (CVE-2024-1597). Fix: Update that package to its patched version.
Serious CVE-2024-1597 pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE

flink-learning-sql/pom.xml

A package you depend on has a known security hole (CVE-2024-1597). Fix: Update that package to its patched version.
Serious CVE-2024-1597 pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE

pom.xml

A package you depend on has a known security hole (CVE-2024-1597). Fix: Update that package to its patched version.
Worth fixing GHSA-72hv-8253-57qq jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition

flink-learning-basic/flink-learning-data-sinks/pom.xml

A package you depend on has a known security hole (GHSA-72hv-8253-57qq). Fix: Update that package to its patched version.
Worth fixing CVE-2026-54512 jackson-databind contains the general-purpose data-binding functionali ...

flink-learning-basic/flink-learning-data-sinks/pom.xml

A package you depend on has a known security hole (CVE-2026-54512). Fix: Update that package to its patched version.
Worth fixing CVE-2026-54513 jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

flink-learning-basic/flink-learning-data-sinks/pom.xml

A package you depend on has a known security hole (CVE-2026-54513). Fix: Update that package to its patched version.
Worth fixing CVE-2026-54514 jackson-databind contains the general-purpose data-binding functionali ...

flink-learning-basic/flink-learning-data-sinks/pom.xml

A package you depend on has a known security hole (CVE-2026-54514). Fix: Update that package to its patched version.
Worth fixing CVE-2026-54515 jackson-databind contains the general-purpose data-binding functionali ...

flink-learning-basic/flink-learning-data-sinks/pom.xml

A package you depend on has a known security hole (CVE-2026-54515). Fix: Update that package to its patched version.
Worth fixing CVE-2017-3523 mysql-connector-java: Improper automatic deserialization of binary data (CPU Apr 2017)

flink-learning-basic/flink-learning-data-sinks/pom.xml

A package you depend on has a known security hole (CVE-2017-3523). Fix: Update that package to its patched version.
Worth fixing CVE-2018-3258 mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018)

flink-learning-basic/flink-learning-data-sinks/pom.xml

A package you depend on has a known security hole (CVE-2018-3258). Fix: Update that package to its patched version.
Worth fixing CVE-2015-2575 mysql-connector-java: unspecified vulnerability related to Connector/J (CPU April 2015)

flink-learning-basic/flink-learning-data-sinks/pom.xml

A package you depend on has a known security hole (CVE-2015-2575). Fix: Update that package to its patched version.
Worth fixing CVE-2017-3586 mysql-connector-java: Connector/J unspecified vulnerability (CPU Apr 2017)

flink-learning-basic/flink-learning-data-sinks/pom.xml

A package you depend on has a known security hole (CVE-2017-3586). Fix: Update that package to its patched version.
Worth fixing CVE-2019-2692 mysql-connector-java: privilege escalation in MySQL connector

flink-learning-basic/flink-learning-data-sinks/pom.xml

A package you depend on has a known security hole (CVE-2019-2692). Fix: Update that package to its patched version.
Worth fixing CVE-2022-21363 mysql-connector-java: Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors

flink-learning-basic/flink-learning-data-sinks/pom.xml

A package you depend on has a known security hole (CVE-2022-21363). Fix: Update that package to its patched version.
Worth fixing CVE-2026-35554 Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management

flink-learning-basic/flink-learning-data-sinks/pom.xml

A package you depend on has a known security hole (CVE-2026-35554). Fix: Update that package to its patched version.
Worth fixing CVE-2024-31141 kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider

flink-learning-basic/flink-learning-data-sinks/pom.xml

A package you depend on has a known security hole (CVE-2024-31141). Fix: Update that package to its patched version.
Worth fixing CVE-2025-27817 org.apache.kafka: Kafka Client Arbitrary File Read SSRF

flink-learning-basic/flink-learning-data-sinks/pom.xml

A package you depend on has a known security hole (CVE-2025-27817). Fix: Update that package to its patched version.

… 1184 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ timed out

Your dependencies cross-checked against the OSV vulnerability database.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OSV-Scanner v1.9.2 · Apache-2.0

error: timeout after 1800s

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited — injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious — typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ 8 notes

Maintenance & supply-chain hygiene. A signal about the project — not a vulnerability in your code.

Worth fixing scorecard-overall OpenSSF Scorecard overall: 3.8/10

A project-health signal (maintenance / supply-chain hygiene) — not a vulnerability in your code.
Minor scorecard-CI-Tests CI-Tests scored 0: 0 out of 9 merged PRs checked by a CI test -- score normalized to 0

A project-health signal (maintenance / supply-chain hygiene) — not a vulnerability in your code.
Minor scorecard-CII-Best-Practices CII-Best-Practices scored 0: no effort to earn an OpenSSF best practices badge detected

A project-health signal (maintenance / supply-chain hygiene) — not a vulnerability in your code.
Minor scorecard-Fuzzing Fuzzing scored 0: project is not fuzzed

A project-health signal (maintenance / supply-chain hygiene) — not a vulnerability in your code.
Minor scorecard-Maintained Maintained scored 0: 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0

A project-health signal (maintenance / supply-chain hygiene) — not a vulnerability in your code.
Minor scorecard-Pinned-Dependencies Pinned-Dependencies scored 0: dependency not pinned by hash detected -- score normalized to 0

A project-health signal (maintenance / supply-chain hygiene) — not a vulnerability in your code.
Minor scorecard-SAST SAST scored 0: SAST tool is not run on all commits -- score normalized to 0

A project-health signal (maintenance / supply-chain hygiene) — not a vulnerability in your code.
Minor scorecard-Security-Policy Security-Policy scored 0: security policy file not detected

A project-health signal (maintenance / supply-chain hygiene) — not a vulnerability in your code.

via OpenSSF Scorecard v5.5.0 · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.