zyphrzero/pytest-api-auto

API keys, passwords or tokens committed into the repo.

• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  common/config.yaml:33
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  common/config.yaml:34
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  common/config.yaml:50
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Worth fixing CVE-2024-56201 jinja2: Jinja has a sandbox breakout through malicious filenames
  requirements.txt
  A package you depend on has a known security hole (CVE-2024-56201). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-56326 jinja2: Jinja has a sandbox breakout through indirect reference to format method
  requirements.txt
  A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-27516 jinja2: Jinja sandbox breakout through attr filter selecting format method
  requirements.txt
  A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-26007 cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
  requirements.txt
  A package you depend on has a known security hole (CVE-2026-26007). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-69249 python-cryptography is a package designed to expose cryptographic prim ...
  requirements.txt
  A package you depend on has a known security hole (CVE-2026-69249). Fix: Update that package to its patched version.
• Worth fixing GHSA-537c-gmf6-5ccf Vulnerable OpenSSL included in cryptography wheels
  requirements.txt
  A package you depend on has a known security hole (GHSA-537c-gmf6-5ccf). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-69248 cryptography is a package designed to expose cryptographic primitives ...
  requirements.txt
  A package you depend on has a known security hole (CVE-2026-69248). Fix: Update that package to its patched version.
• Worth fixing GHSA-h4gh-qq45-vh27 pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels
  requirements.txt
  A package you depend on has a known security hole (GHSA-h4gh-qq45-vh27). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-23217 mitmproxy is a interactive TLS-capable intercepting HTTP proxy for pen ...
  requirements.txt
  A package you depend on has a known security hole (CVE-2025-23217). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-40606 mitmproxy is a interactive TLS-capable intercepting HTTP proxy for pen ...
  requirements.txt
  A package you depend on has a known security hole (CVE-2026-40606). Fix: Update that package to its patched version.
• Worth fixing GHSA-63cx-g855-hvv4 mitmproxy binaries embed a vulnerable python-hyper/h2 dependency
  requirements.txt
  A package you depend on has a known security hole (GHSA-63cx-g855-hvv4). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-71176 pytest: pytest: Denial of Service or Privilege Escalation via insecure temporary directory handling
  requirements.txt
  A package you depend on has a known security hole (CVE-2025-71176). Fix: Update that package to its patched version.
• Worth fixing CVE-2024-47081 requests: Requests vulnerable to .netrc credentials leak via malicious URLs
  requirements.txt
  A package you depend on has a known security hole (CVE-2024-47081). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-25645 requests: Requests: Security bypass due to predictable temporary file creation
  requirements.txt
  A package you depend on has a known security hole (CVE-2026-25645). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-66418 urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion
  requirements.txt
  A package you depend on has a known security hole (CVE-2025-66418). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-66471 urllib3: urllib3 Streaming API improperly handles highly compressed data
  requirements.txt
  A package you depend on has a known security hole (CVE-2025-66471). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-21441 urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
  requirements.txt
  A package you depend on has a known security hole (CVE-2026-21441). Fix: Update that package to its patched version.
• Worth fixing CVE-2026-44431 urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers
  requirements.txt
  A package you depend on has a known security hole (CVE-2026-44431). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-50181 urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
  requirements.txt
  A package you depend on has a known security hole (CVE-2025-50181). Fix: Update that package to its patched version.
• Worth fixing CVE-2025-50182 urllib3: urllib3 does not control redirects in browsers and Node.js
  requirements.txt
  A package you depend on has a known security hole (CVE-2025-50182). Fix: Update that package to its patched version.
• Minor CVE-2024-12797 openssl: RFC7250 handshakes with unauthenticated servers don't abort as expected
  requirements.txt
  A package you depend on has a known security hole (CVE-2024-12797). Fix: Update that package to its patched version.
• Minor CVE-2026-34073 python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation
  requirements.txt
  A package you depend on has a known security hole (CVE-2026-34073). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious PYSEC-2026-348 h11 accepts some malformed Chunked-Encoding bodies
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2025-43859). Fix: Update that package to its patched version.
• Serious PYSEC-2026-2269 pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2026-27459). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1471 Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2025-27516). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1472 Jinja has a sandbox breakout through malicious filenames
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2024-56201). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1475 Jinja has a sandbox breakout through indirect reference to format method
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2024-56326). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2141 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), Ellip
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2026-26007). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-35 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child cert
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2026-34073). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-3553 python-cryptography: Duplicate self-signed intermediates can cause exponential path-building
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2026-69249). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-3554 python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2026-69248). Fix: Update that package to its patched version.
• Worth fixing GHSA-537c-gmf6-5ccf Vulnerable OpenSSL included in cryptography wheels
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1630 Mitmweb API Authentication Bypass Using Proxy Server
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2025-23217). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-92 mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. In mitmproxy 12.2.1 and below, the bu
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2026-40606). Fix: Update that package to its patched version.
• Worth fixing GHSA-63cx-g855-hvv4 mitmproxy binaries embed a vulnerable python-hyper/h2 dependency
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole. Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1845 pytest has vulnerable tmpdir handling
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2025-71176). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1872 Requests vulnerable to .netrc credentials leak via malicious URLs
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2024-47081). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2275 Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system te
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2026-25645). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-141 urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=Fal
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2026-44431). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1994 urllib3 streaming API improperly handles highly compressed data
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2025-66471). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1996 Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2026-21441). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1997 urllib3 does not control redirects in browsers and Node.js
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2025-50182). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1998 urllib3 allows an unbounded number of links in the decompression chain
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2025-66418). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1999 urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2025-50181). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2401 Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2025-6176). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2151 Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Us
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2026-27205). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-1435 h2 allows HTTP Request Smuggling due to illegal characters in headers
  /workdirs/scan-6317b4d4-959e-4862-8f42-79a3373d47ca/requirements.txt
  A package you depend on has a known security hole (CVE-2025-57804). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

• Serious guarddog-pypi-code-execution code-execution match in pyperclip 1.8.2
  pyperclip
  A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.
• Serious guarddog-pypi-code-execution code-execution match in pandas 2.2.2
  pandas
  A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.
• Worth fixing guarddog-pypi-clipboard-access clipboard-access match in pyperclip 1.8.2
  pyperclip
  A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.
• Worth fixing guarddog-pypi-clipboard-access clipboard-access match in mitmproxy 10.3.1
  mitmproxy
  A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.

via Guarddog v2.10.0 · Apache-2.0