Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

tirth8205/code-review-graph

https://github.com/tirth8205/code-review-graph · scanned 2026-07-23 19:39 UTC (1 month, 2 weeks ago)

259 raw signals (0 security + 259 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month, 2 weeks ago · v7 · 255 actionable findings from 1 signal source. 4 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
69.0
/100
Security checks
69
0 findings
System graph
69
90.0% cov · 255 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: severity: medium × excluding tests × Reset all
Severity: Critical 0 High 47 Medium 150 Low 56 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 255 Crowd 0 Layer: Software 27 Security 79 Quality 24 Frontend 1 Cicd 1 Dependencies 123
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 69.0/100 with 90.0% coverage. It contains 3736 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 259 findings — concentrated in dependencies (123), security (79), software (27). Risk profile is high: 0 critical, 47 high, 150 medium. Recommended next step: open the dependencies layer findings first — that's where the highest-impact wins live.

Showing 150 of 255 actionable findings. 259 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .mcp.json
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.mcp.json VerificationMcp config
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/build-graph/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/build-graph/SKILL.md VerificationSkill file
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/debug-issue/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/debug-issue/SKILL.md VerificationSkill file
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: skills/explore-codebase/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
skills/explore-codebase/SKILL.md VerificationSkill file
medium System graph security Trivy conf 1.00 AWS-0010: Cloudfront distribution should have Access Logging configured — tests/fixtures/sample.tf
Cloudfront distribution should have Access Logging configured Distribution does not have logging enabled Rule: AWS-0010 Severity: MEDIUM Target: tests/fixtures/sample.tf
Misconfig
medium System graph security Trivy conf 1.00 AWS-0090: S3 Data should be versioned — tests/fixtures/sample.tf
S3 Data should be versioned Bucket does not have versioning enabled Rule: AWS-0090 Severity: MEDIUM Target: tests/fixtures/sample.tf
Misconfig
medium System graph security Trivy conf 1.00 AWS-0178: VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet "Rejects" for VPCs. — tests/fixtures/sample.tf
VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet "Reject…
Misconfig
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security Trivy conf 1.00 CVE-2025-71176: pytest 8.4.2 — uv.lock
pytest: pytest: Denial of Service or Privilege Escalation via insecure temporary directory handling pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges. Package: pytest In…
VulnCve 2025 71176
medium System graph security Trivy conf 1.00 CVE-2026-1839: transformers 4.57.6 — uv.lock
transformers: HuggingFace Transformers: Arbitrary code execution via malicious checkpoint file A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_load_rng_state()` method in `src/transformers/trainer.py` at line …
VulnCve 2026 1839
medium System graph security Trivy conf 1.00 CVE-2026-25645: requests 2.32.5 — uv.lock
requests: Requests: Security bypass due to predictable temporary file creation Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. …
VulnCve 2026 25645
medium System graph security Trivy conf 1.00 CVE-2026-39892: cryptography 46.0.5 — uv.lock
cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.…
VulnCve 2026 39892
medium System graph security Trivy conf 1.00 CVE-2026-40347: python-multipart 0.0.22 — uv.lock
python-multipart: Python-Multipart: Denial of Service via crafted multipart/form-data requests Python-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epi…
VulnCve 2026 40347
medium System graph security Trivy conf 1.00 CVE-2026-41425: authlib 1.6.9 — uv.lock
authlib: Authlib: Cross-Site Request Forgery (CSRF) vulnerability in OAuth cache feature Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starlette_client.OAuth. This vulnerability …
VulnCve 2026 41425
medium System graph security Trivy conf 1.00 CVE-2026-41479: authlib 1.6.9 — uv.lock
Authlib is a Python library which builds OAuth and OpenID Connect serv ... Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.10 and 1.7.1, Authlib's OAuth 2.0 authorization endpoint can be turned into an unauthenticated open redirect when a request uses an uns…
VulnCve 2026 41479
medium System graph security Trivy conf 1.00 CVE-2026-42308: pillow 12.1.1 — uv.lock
Pillow: python: Pillow: Denial of Service via integer overflow in font processing Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This i…
VulnCve 2026 42308
medium System graph security Trivy conf 1.00 CVE-2026-42309: pillow 12.1.1 — uv.lock
Pillow: Pillow: Denial of Service via specially crafted coordinate input Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw…
VulnCve 2026 42309
medium System graph security Trivy conf 1.00 CVE-2026-42310: pillow 12.1.1 — uv.lock
Pillow: Pillow: Denial of Service via malicious PDF processing Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issu…
VulnCve 2026 42310
medium System graph security Trivy conf 1.00 CVE-2026-44681: authlib 1.6.9 — uv.lock
Authlib is a Python library which builds OAuth and OpenID Connect serv ... Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoint lets a rem…
VulnCve 2026 44681
medium System graph security Trivy conf 1.00 CVE-2026-45409: idna 3.11 — uv.lock
python-idna: idna: Denial of Service via specially crafted long inputs Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as …
VulnCve 2026 45409
medium System graph security Trivy conf 1.00 CVE-2026-48522: pyjwt 2.12.1 — uv.lock
python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python stdlib's default OpenerDirector regis…
VulnCve 2026 48522
medium System graph security Trivy conf 1.00 CVE-2026-48523: pyjwt 2.12.1 — uv.lock
python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access PyJWT is a JSON Web Token implementation in Python. From 2.9.0 to 2.12.1, there is a verifier-side algorithm allow-list bypass when jwt.decode() or jwt.decode_complete() are called with a PyJWK key. The to…
VulnCve 2026 48523
medium System graph security Trivy conf 1.00 CVE-2026-48525: pyjwt 2.12.1 — uv.lock
python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens PyJWT is a JSON Web Token implementation in Python. From 2.8.0 to 2.12.1, when verifying detached JWS tokens using the unencoded-payload option ("b64": false, RFC 7797), PyJWT performs Base64URL decoding of the co…
VulnCve 2026 48525
medium System graph security Trivy conf 1.00 CVE-2026-48710: starlette 0.52.1 — uv.lock
starlette: Starlette: Security restriction bypass via malformed HTTP Host header Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the r…
VulnCve 2026 48710
medium System graph security Trivy conf 1.00 CVE-2026-48817: starlette 0.52.1 — uv.lock
starlette: Starlette: Information disclosure and unintended method execution via non-standard HTTP methods Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up a…
VulnCve 2026 48817
medium System graph security Trivy conf 1.00 CVE-2026-55798: pillow 12.1.1 — uv.lock
python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result t…
VulnCve 2026 55798
medium System graph security Trivy conf 1.00 CVE-2026-59198: pillow 12.1.1 — uv.lock
Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copie…
VulnCve 2026 59198
medium System graph security Trivy conf 1.00 CVE-2026-59203: pillow 12.1.1 — uv.lock
Pillow: Pillow: Denial of Service via crafted EPS file Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to t…
VulnCve 2026 59203
medium System graph security Trivy conf 1.00 CVE-2026-59890: setuptools 82.0.1 — uv.lock
setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursiv…
VulnCve 2026 59890
medium System graph security Semgrep conf 0.55 dynamic urllib use detected — code_review_graph/embeddings.py:293
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
code_review_graph/embeddings.py:293 SecurityPython
medium System graph security Semgrep conf 0.55 dynamic urllib use detected — scripts/diagnose_pypi_connectivity.py:54
Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. R…
scripts/diagnose_pypi_connectivity.py:54 SecurityPython
medium System graph security Trivy conf 1.00 GHSA-4xgf-cpjx-pc3j: pydantic-settings 2.13.1 — uv.lock
pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size ### Summary `NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_nested_subdir=True`, a directory e…
VulnGhsa 4xgf cpjx pc3j
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in code-review-graph-vscode/src/webview/graph.ts:670
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
code-review-graph-vscode/src/webview/graph.ts:670 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'insert_adjacent_html' in code_review_graph/visualization.py:829
Found a known-risky pattern (insert_adjacent_html). Review and replace if possible.
code_review_graph/visualization.py:829 Insert adjacent html
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — code_review_graph/daemon.py:1058
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
code_review_graph/daemon.py:1058 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — code_review_graph/eval/benchmarks/impact_accuracy.py:35
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
code_review_graph/eval/benchmarks/impact_accuracy.py:35 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — code_review_graph/eval/benchmarks/token_efficiency.py:28
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
code_review_graph/eval/benchmarks/token_efficiency.py:28 runtime safetyRobustness
medium System graph quality Integrity conf 0.85 Network/subprocess call without timeout or try/except — code_review_graph/eval/runner.py:97
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
code_review_graph/eval/runner.py:97 runtime safetyRobustness
medium System graph security Coverage conf 1.00 No auth library detected
The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing.
auth
medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected
Found 34 placeholder/mock markers across 10 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.
Mock dataIncompleteGenerated repo pattern
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency authlib 1.6.9: GHSA-jj8c-mmj3-mmgv
OSV.dev reports `authlib` at version `1.6.9` (resolved in `uv.lock`) is affected by GHSA-jj8c-mmj3-mmgv. Note: `authlib` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jj8c-mmj3…
uv.lock ScaOsvGhsa jj8c mmj3 mmgv
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency authlib 1.6.9: GHSA-r95x-qfjj-fjj2
OSV.dev reports `authlib` at version `1.6.9` (resolved in `uv.lock`) is affected by GHSA-r95x-qfjj-fjj2. Note: `authlib` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-r95x-qfjj…
uv.lock ScaOsvGhsa r95x qfjj fjj2
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency authlib 1.6.9: GHSA-w8p2-r796-3vmq
OSV.dev reports `authlib` at version `1.6.9` (resolved in `uv.lock`) is affected by GHSA-w8p2-r796-3vmq. Note: `authlib` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-w8p2-r796…
uv.lock ScaOsvGhsa w8p2 r796 3vmq
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency authlib 1.6.9: PYSEC-2026-188
OSV.dev reports `authlib` at version `1.6.9` (resolved in `uv.lock`) is affected by PYSEC-2026-188. Note: `authlib` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-188 Fix:…
uv.lock ScaOsvPysec 2026 188
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency authlib 1.6.9: PYSEC-2026-2119
OSV.dev reports `authlib` at version `1.6.9` (resolved in `uv.lock`) is affected by PYSEC-2026-2119. Note: `authlib` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2119 Fi…
uv.lock ScaOsvPysec 2026 2119
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency authlib 1.6.9: PYSEC-2026-25
OSV.dev reports `authlib` at version `1.6.9` (resolved in `uv.lock`) is affected by PYSEC-2026-25. Note: `authlib` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-25 Fix: u…
uv.lock ScaOsvPysec 2026 25
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 1.1.12: GHSA-f886-m6hf-6m8v
OSV.dev reports `brace-expansion` at version `1.1.12` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-f886-m6hf-6m8v. Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Ad…
code-review-graph-vscode/package-lock.json ScaOsvGhsa f886 m6hf 6m8v
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency click 8.3.1: PYSEC-2026-2132
OSV.dev reports `click` at version `8.3.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2132. Note: `click` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2132 Fix: u…
uv.lock ScaOsvPysec 2026 2132
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency cryptography 46.0.5: GHSA-m959-cc7f-wv43
OSV.dev reports `cryptography` at version `46.0.5` (resolved in `uv.lock`) is affected by GHSA-m959-cc7f-wv43. Note: `cryptography` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHS…
uv.lock ScaOsvGhsa m959 cc7f wv43
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency cryptography 46.0.5: GHSA-p423-j2cm-9vmq
OSV.dev reports `cryptography` at version `46.0.5` (resolved in `uv.lock`) is affected by GHSA-p423-j2cm-9vmq. Note: `cryptography` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHS…
uv.lock ScaOsvGhsa p423 j2cm 9vmq
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency cryptography 46.0.5: PYSEC-2026-35
OSV.dev reports `cryptography` at version `46.0.5` (resolved in `uv.lock`) is affected by PYSEC-2026-35. Note: `cryptography` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-202…
uv.lock ScaOsvPysec 2026 35
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency cryptography 46.0.5: PYSEC-2026-36
OSV.dev reports `cryptography` at version `46.0.5` (resolved in `uv.lock`) is affected by PYSEC-2026-36. Note: `cryptography` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-202…
uv.lock ScaOsvPysec 2026 36
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency esbuild 0.20.2: GHSA-67mh-4wv8-2f99
OSV.dev reports `esbuild` at version `0.20.2` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-67mh-4wv8-2f99. esbuild enables any website to send any requests to the development server and read the response Advisory: https://osv.dev/vulnerability/GHSA-67mh-4wv8-2f99…
code-review-graph-vscode/package.json ScaOsvGhsa 67mh 4wv8 2f99
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency form-data 4.0.5: GHSA-hmw2-7cc7-3qxx
OSV.dev reports `form-data` at version `4.0.5` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-hmw2-7cc7-3qxx. Note: `form-data` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https…
code-review-graph-vscode/package-lock.json ScaOsvGhsa hmw2 7cc7 3qxx
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency httplib2 0.31.2: PYSEC-2026-3444
OSV.dev reports `httplib2` at version `0.31.2` (resolved in `uv.lock`) is affected by PYSEC-2026-3444. Note: `httplib2` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3444…
uv.lock ScaOsvPysec 2026 3444
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency idna 3.11: GHSA-65pc-fj4g-8rjx
OSV.dev reports `idna` at version `3.11` (resolved in `uv.lock`) is affected by GHSA-65pc-fj4g-8rjx (aka CVE-2026-45409). Note: `idna` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Internationalized Domain Names in Applications (IDNA): Specially cr…
uv.lock ScaOsvGhsa 65pc fj4g 8rjx
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency linkify-it 3.0.3: GHSA-v245-v573-v5vm
OSV.dev reports `linkify-it` at version `3.0.3` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-v245-v573-v5vm. Note: `linkify-it` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: htt…
code-review-graph-vscode/package-lock.json ScaOsvGhsa v245 v573 v5vm
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency markdown-it 12.3.2: GHSA-6v5v-wf23-fmfq
OSV.dev reports `markdown-it` at version `12.3.2` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-6v5v-wf23-fmfq. Note: `markdown-it` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: …
code-review-graph-vscode/package-lock.json ScaOsvGhsa 6v5v wf23 fmfq
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mcp 1.26.0: GHSA-hvrp-rf83-w775
OSV.dev reports `mcp` at version `1.26.0` (resolved in `uv.lock`) is affected by GHSA-hvrp-rf83-w775. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-hvrp-rf83-w775 Fix: upgrade `mcp` past the affected range per the advisory.
uv.lock ScaOsvGhsa hvrp rf83 w775
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mcp 1.26.0: GHSA-jpw9-pfvf-9f58
OSV.dev reports `mcp` at version `1.26.0` (resolved in `uv.lock`) is affected by GHSA-jpw9-pfvf-9f58. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jpw9-pfvf-9f58 Fix: upgrade `mcp` past the affected range per the advisory.
uv.lock ScaOsvGhsa jpw9 pfvf 9f58
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mcp 1.26.0: GHSA-vj7q-gjh5-988w
OSV.dev reports `mcp` at version `1.26.0` (resolved in `uv.lock`) is affected by GHSA-vj7q-gjh5-988w. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vj7q-gjh5-988w Fix: upgrade `mcp` past the affected range per the advisory.
uv.lock ScaOsvGhsa vj7q gjh5 988w
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mcp 1.26.0: PYSEC-2026-3481
OSV.dev reports `mcp` at version `1.26.0` (resolved in `uv.lock`) is affected by PYSEC-2026-3481. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3481 Fix: upgrade `mcp` past the affected range per the advisory.
uv.lock ScaOsvPysec 2026 3481
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mcp 1.26.0: PYSEC-2026-3482
OSV.dev reports `mcp` at version `1.26.0` (resolved in `uv.lock`) is affected by PYSEC-2026-3482. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3482 Fix: upgrade `mcp` past the affected range per the advisory.
uv.lock ScaOsvPysec 2026 3482
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mcp 1.26.0: PYSEC-2026-3483
OSV.dev reports `mcp` at version `1.26.0` (resolved in `uv.lock`) is affected by PYSEC-2026-3483. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3483 Fix: upgrade `mcp` past the affected range per the advisory.
uv.lock ScaOsvPysec 2026 3483
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-4x4j-2g7c-83w6
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-4x4j-2g7c-83w6 (aka CVE-2026-55798). Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Pillow: WindowsViewer.get_command() OS command injection via …
uv.lock ScaOsvGhsa 4x4j 2g7c 83w6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-5xmw-vc9v-4wf2
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-5xmw-vc9v-4wf2 (aka CVE-2026-42309). Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Pillow has a heap buffer overflow with nested list coordinate…
uv.lock ScaOsvGhsa 5xmw vc9v 4wf2
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-6r8x-57c9-28j4
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-6r8x-57c9-28j4. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-6r8x-57c9-…
uv.lock ScaOsvGhsa 6r8x 57c9 28j4
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-8v84-f9pq-wr9x
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-8v84-f9pq-wr9x. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-8v84-f9pq-…
uv.lock ScaOsvGhsa 8v84 f9pq wr9x
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-9hw9-ch79-4vh6
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-9hw9-ch79-4vh6. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-9hw9-ch79-…
uv.lock ScaOsvGhsa 9hw9 ch79 4vh6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-fj7v-r99m-22gq
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-fj7v-r99m-22gq. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-fj7v-r99m-…
uv.lock ScaOsvGhsa fj7v r99m 22gq
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-jjj6-mw9f-p565
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-jjj6-mw9f-p565. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jjj6-mw9f-…
uv.lock ScaOsvGhsa jjj6 mw9f p565
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-pg7v-jwj7-p798
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-pg7v-jwj7-p798. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pg7v-jwj7-…
uv.lock ScaOsvGhsa pg7v jwj7 p798
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-phj9-mv4w-65pm
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-phj9-mv4w-65pm. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-phj9-mv4w-…
uv.lock ScaOsvGhsa phj9 mv4w 65pm
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-pwv6-vv43-88gr
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-pwv6-vv43-88gr. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pwv6-vv43-…
uv.lock ScaOsvGhsa pwv6 vv43 88gr
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-r73j-pqj5-w3x7
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-r73j-pqj5-w3x7. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-r73j-pqj5-…
uv.lock ScaOsvGhsa r73j pqj5 w3x7
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-vjc4-5qp5-m44j
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-vjc4-5qp5-m44j. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vjc4-5qp5-…
uv.lock ScaOsvGhsa vjc4 5qp5 m44j
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-whj4-6x5x-4v2j
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-whj4-6x5x-4v2j. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-whj4-6x5x-…
uv.lock ScaOsvGhsa whj4 6x5x 4v2j
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-wjx4-4jcj-g98j
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-wjx4-4jcj-g98j. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wjx4-4jcj-…
uv.lock ScaOsvGhsa wjx4 4jcj g98j
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: GHSA-xj96-63gp-2gmr
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by GHSA-xj96-63gp-2gmr. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xj96-63gp-…
uv.lock ScaOsvGhsa xj96 63gp 2gmr
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-165
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-165. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-165 Fix: …
uv.lock ScaOsvPysec 2026 165
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-2250
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2250. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2250 Fix…
uv.lock ScaOsvPysec 2026 2250
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-2252
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2252. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2252 Fix…
uv.lock ScaOsvPysec 2026 2252
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-2253
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2253. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2253 Fix…
uv.lock ScaOsvPysec 2026 2253
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-2256
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2256. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2256 Fix…
uv.lock ScaOsvPysec 2026 2256
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-2874
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2874. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2874 Fix…
uv.lock ScaOsvPysec 2026 2874
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-3451
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-3451. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3451 Fix…
uv.lock ScaOsvPysec 2026 3451
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-3452
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-3452. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3452 Fix…
uv.lock ScaOsvPysec 2026 3452
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-3453
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-3453. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3453 Fix…
uv.lock ScaOsvPysec 2026 3453
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-3454
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-3454. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3454 Fix…
uv.lock ScaOsvPysec 2026 3454
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-3494
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-3494. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3494 Fix…
uv.lock ScaOsvPysec 2026 3494
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-3495
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-3495. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3495 Fix…
uv.lock ScaOsvPysec 2026 3495
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pillow 12.1.1: PYSEC-2026-3496
OSV.dev reports `pillow` at version `12.1.1` (resolved in `uv.lock`) is affected by PYSEC-2026-3496. Note: `pillow` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3496 Fix…
uv.lock ScaOsvPysec 2026 3496
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyasn1 0.6.3: GHSA-8ppf-4f7h-5ppj
OSV.dev reports `pyasn1` at version `0.6.3` (resolved in `uv.lock`) is affected by GHSA-8ppf-4f7h-5ppj. Note: `pyasn1` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-8ppf-4f7h-5…
uv.lock ScaOsvGhsa 8ppf 4f7h 5ppj
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyasn1 0.6.3: GHSA-hm4w-wwcw-mr6r
OSV.dev reports `pyasn1` at version `0.6.3` (resolved in `uv.lock`) is affected by GHSA-hm4w-wwcw-mr6r. Note: `pyasn1` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-hm4w-wwcw-m…
uv.lock ScaOsvGhsa hm4w wwcw mr6r
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyasn1 0.6.3: PYSEC-2026-3455
OSV.dev reports `pyasn1` at version `0.6.3` (resolved in `uv.lock`) is affected by PYSEC-2026-3455. Note: `pyasn1` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3455 Fix:…
uv.lock ScaOsvPysec 2026 3455
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyasn1 0.6.3: PYSEC-2026-3456
OSV.dev reports `pyasn1` at version `0.6.3` (resolved in `uv.lock`) is affected by PYSEC-2026-3456. Note: `pyasn1` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3456 Fix:…
uv.lock ScaOsvPysec 2026 3456
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyasn1 0.6.3: PYSEC-2026-3457
OSV.dev reports `pyasn1` at version `0.6.3` (resolved in `uv.lock`) is affected by PYSEC-2026-3457. Note: `pyasn1` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-3457 Fix:…
uv.lock ScaOsvPysec 2026 3457
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pydantic-settings 2.13.1: GHSA-4xgf-cpjx-pc3j
OSV.dev reports `pydantic-settings` at version `2.13.1` (resolved in `uv.lock`) is affected by GHSA-4xgf-cpjx-pc3j (aka CVE-2026-58203). Note: `pydantic-settings` is a transitive dependency — pulled in by another package, not declared directly in a manifest. pydantic-settings: NestedSecretsSetting…
uv.lock ScaOsvGhsa 4xgf cpjx pc3j
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pygments 2.19.2: GHSA-5239-wwwm-4pmq
OSV.dev reports `pygments` at version `2.19.2` (resolved in `uv.lock`) is affected by GHSA-5239-wwwm-4pmq (aka CVE-2026-4539). Note: `pygments` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Pygments has Regular Expression Denial of Service (ReDoS) …
uv.lock ScaOsvGhsa 5239 wwwm 4pmq
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyjwt 2.12.1: GHSA-993g-76c3-p5m4
OSV.dev reports `pyjwt` at version `2.12.1` (resolved in `uv.lock`) is affected by GHSA-993g-76c3-p5m4. Note: `pyjwt` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-993g-76c3-p5…
uv.lock ScaOsvGhsa 993g 76c3 p5m4
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyjwt 2.12.1: GHSA-fhv5-28vv-h8m8
OSV.dev reports `pyjwt` at version `2.12.1` (resolved in `uv.lock`) is affected by GHSA-fhv5-28vv-h8m8. Note: `pyjwt` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-fhv5-28vv-h8…
uv.lock ScaOsvGhsa fhv5 28vv h8m8
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyjwt 2.12.1: GHSA-jq35-7prp-9v3f
OSV.dev reports `pyjwt` at version `2.12.1` (resolved in `uv.lock`) is affected by GHSA-jq35-7prp-9v3f. Note: `pyjwt` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jq35-7prp-9v…
uv.lock ScaOsvGhsa jq35 7prp 9v3f
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyjwt 2.12.1: GHSA-w7vc-732c-9m39
OSV.dev reports `pyjwt` at version `2.12.1` (resolved in `uv.lock`) is affected by GHSA-w7vc-732c-9m39. Note: `pyjwt` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-w7vc-732c-9m…
uv.lock ScaOsvGhsa w7vc 732c 9m39
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyjwt 2.12.1: GHSA-xgmm-8j9v-c9wx
OSV.dev reports `pyjwt` at version `2.12.1` (resolved in `uv.lock`) is affected by GHSA-xgmm-8j9v-c9wx. Note: `pyjwt` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xgmm-8j9v-c9…
uv.lock ScaOsvGhsa xgmm 8j9v c9wx
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyjwt 2.12.1: PYSEC-2026-175
OSV.dev reports `pyjwt` at version `2.12.1` (resolved in `uv.lock`) is affected by PYSEC-2026-175. Note: `pyjwt` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-175 Fix: up…
uv.lock ScaOsvPysec 2026 175
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyjwt 2.12.1: PYSEC-2026-177
OSV.dev reports `pyjwt` at version `2.12.1` (resolved in `uv.lock`) is affected by PYSEC-2026-177. Note: `pyjwt` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-177 Fix: up…
uv.lock ScaOsvPysec 2026 177
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyjwt 2.12.1: PYSEC-2026-178
OSV.dev reports `pyjwt` at version `2.12.1` (resolved in `uv.lock`) is affected by PYSEC-2026-178. Note: `pyjwt` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-178 Fix: up…
uv.lock ScaOsvPysec 2026 178
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pyjwt 2.12.1: PYSEC-2026-179
OSV.dev reports `pyjwt` at version `2.12.1` (resolved in `uv.lock`) is affected by PYSEC-2026-179. Note: `pyjwt` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-179 Fix: up…
uv.lock ScaOsvPysec 2026 179
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pytest 8.4.2: GHSA-6w46-j5rx-g56g
OSV.dev reports `pytest` at version `8.4.2` (resolved in `uv.lock`) is affected by GHSA-6w46-j5rx-g56g. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-6w46-j5rx-g56g Fix: upgrade `pytest` past the affected range per the advisory.
uv.lock ScaOsvGhsa 6w46 j5rx g56g
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pytest 8.4.2: PYSEC-2026-1845
OSV.dev reports `pytest` at version `8.4.2` (resolved in `uv.lock`) is affected by PYSEC-2026-1845. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-1845 Fix: upgrade `pytest` past the affected range per the advisory.
uv.lock ScaOsvPysec 2026 1845
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: GHSA-6jv3-5f52-599m
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by GHSA-6jv3-5f52-599m. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabi…
uv.lock ScaOsvGhsa 6jv3 5f52 599m
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: GHSA-mj87-hwqh-73pj
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by GHSA-mj87-hwqh-73pj. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabi…
uv.lock ScaOsvGhsa mj87 hwqh 73pj
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: GHSA-pp6c-gr5w-3c5g
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by GHSA-pp6c-gr5w-3c5g. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabi…
uv.lock ScaOsvGhsa pp6c gr5w 3c5g
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: GHSA-v9pg-7xvm-68hf
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by GHSA-v9pg-7xvm-68hf. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabi…
uv.lock ScaOsvGhsa v9pg 7xvm 68hf
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: GHSA-vffw-93wf-4j4q
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by GHSA-vffw-93wf-4j4q. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabi…
uv.lock ScaOsvGhsa vffw 93wf 4j4q
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: PYSEC-2026-3037
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by PYSEC-2026-3037. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability…
uv.lock ScaOsvPysec 2026 3037
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: PYSEC-2026-3038
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by PYSEC-2026-3038. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability…
uv.lock ScaOsvPysec 2026 3038
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: PYSEC-2026-3039
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by PYSEC-2026-3039. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability…
uv.lock ScaOsvPysec 2026 3039
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: PYSEC-2026-3040
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by PYSEC-2026-3040. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability…
uv.lock ScaOsvPysec 2026 3040
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency python-multipart 0.0.22: PYSEC-2026-3041
OSV.dev reports `python-multipart` at version `0.0.22` (resolved in `uv.lock`) is affected by PYSEC-2026-3041. Note: `python-multipart` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability…
uv.lock ScaOsvPysec 2026 3041
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency qs 6.15.0: GHSA-q8mj-m7cp-5q26
OSV.dev reports `qs` at version `6.15.0` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-q8mj-m7cp-5q26. Note: `qs` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vu…
code-review-graph-vscode/package-lock.json ScaOsvGhsa q8mj m7cp 5q26
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency requests 2.32.5: GHSA-gc5v-m9x4-r6x2
OSV.dev reports `requests` at version `2.32.5` (resolved in `uv.lock`) is affected by GHSA-gc5v-m9x4-r6x2. Note: `requests` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-gc5v-m…
uv.lock ScaOsvGhsa gc5v m9x4 r6x2
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency requests 2.32.5: PYSEC-2026-2275
OSV.dev reports `requests` at version `2.32.5` (resolved in `uv.lock`) is affected by PYSEC-2026-2275. Note: `requests` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-2275…
uv.lock ScaOsvPysec 2026 2275
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency setuptools 82.0.1: GHSA-h35f-9h28-mq5c
OSV.dev reports `setuptools` at version `82.0.1` (resolved in `uv.lock`) is affected by GHSA-h35f-9h28-mq5c. Note: `setuptools` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-h3…
uv.lock ScaOsvGhsa h35f 9h28 mq5c
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency setuptools 82.0.1: PYSEC-2026-3447
OSV.dev reports `setuptools` at version `82.0.1` (resolved in `uv.lock`) is affected by PYSEC-2026-3447. Note: `setuptools` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-…
uv.lock ScaOsvPysec 2026 3447
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: GHSA-82w8-qh3p-5jfq
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by GHSA-82w8-qh3p-5jfq. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-82w8…
uv.lock ScaOsvGhsa 82w8 qh3p 5jfq
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: GHSA-86qp-5c8j-p5mr
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by GHSA-86qp-5c8j-p5mr. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-86qp…
uv.lock ScaOsvGhsa 86qp 5c8j p5mr
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: GHSA-jp82-jpqv-5vv3
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by GHSA-jp82-jpqv-5vv3. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jp82…
uv.lock ScaOsvGhsa jp82 jpqv 5vv3
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: GHSA-wqp7-x3pw-xc5r
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by GHSA-wqp7-x3pw-xc5r. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wqp7…
uv.lock ScaOsvGhsa wqp7 x3pw xc5r
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: GHSA-x746-7m8f-x49c
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by GHSA-x746-7m8f-x49c. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-x746…
uv.lock ScaOsvGhsa x746 7m8f x49c
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: PYSEC-2026-161
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by PYSEC-2026-161. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-161…
uv.lock ScaOsvPysec 2026 161
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: PYSEC-2026-2280
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2280. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-22…
uv.lock ScaOsvPysec 2026 2280
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: PYSEC-2026-2281
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2281. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-22…
uv.lock ScaOsvPysec 2026 2281
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: PYSEC-2026-248
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by PYSEC-2026-248. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-248…
uv.lock ScaOsvPysec 2026 248
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency starlette 0.52.1: PYSEC-2026-249
OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by PYSEC-2026-249. Note: `starlette` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-249…
uv.lock ScaOsvPysec 2026 249
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency tmp 0.2.5: GHSA-ph9p-34f9-6g65
OSV.dev reports `tmp` at version `0.2.5` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-ph9p-34f9-6g65. Note: `tmp` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/v…
code-review-graph-vscode/package-lock.json ScaOsvGhsa ph9p 34f9 6g65
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency torch 2.10.0: GHSA-rrmf-rvhw-rf47
OSV.dev reports `torch` at version `2.10.0` (resolved in `uv.lock`) is affected by GHSA-rrmf-rvhw-rf47. Note: `torch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-rrmf-rvhw-rf…
uv.lock ScaOsvGhsa rrmf rvhw rf47
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency torch 2.10.0: PYSEC-2026-139
OSV.dev reports `torch` at version `2.10.0` (resolved in `uv.lock`) is affected by PYSEC-2026-139. Note: `torch` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-139 Fix: up…
uv.lock ScaOsvPysec 2026 139
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency transformers 4.57.6: GHSA-69w3-r845-3855
OSV.dev reports `transformers` at version `4.57.6` (resolved in `uv.lock`) is affected by GHSA-69w3-r845-3855 (aka CVE-2026-1839). Note: `transformers` is a transitive dependency — pulled in by another package, not declared directly in a manifest. HuggingFace Transformers allows for arbitrary code…
uv.lock ScaOsvGhsa 69w3 r845 3855
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency transformers 4.57.6: GHSA-fgcw-684q-jj6r
OSV.dev reports `transformers` at version `4.57.6` (resolved in `uv.lock`) is affected by GHSA-fgcw-684q-jj6r. Note: `transformers` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHS…
uv.lock ScaOsvGhsa fgcw 684q jj6r
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency transformers 4.57.6: PYSEC-2025-217
OSV.dev reports `transformers` at version `4.57.6` (resolved in `uv.lock`) is affected by PYSEC-2025-217. Note: `transformers` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-20…
uv.lock ScaOsvPysec 2025 217
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency transformers 4.57.6: PYSEC-2026-2290
OSV.dev reports `transformers` at version `4.57.6` (resolved in `uv.lock`) is affected by PYSEC-2026-2290. Note: `transformers` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2…
uv.lock ScaOsvPysec 2026 2290
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency undici 7.24.4: GHSA-hm92-r4w5-c3mj
OSV.dev reports `undici` at version `7.24.4` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-hm92-r4w5-c3mj. Note: `undici` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://os…
code-review-graph-vscode/package-lock.json ScaOsvGhsa hm92 r4w5 c3mj
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency undici 7.24.4: GHSA-p88m-4jfj-68fv
OSV.dev reports `undici` at version `7.24.4` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-p88m-4jfj-68fv (aka CVE-2026-9679). Note: `undici` is a transitive dependency — pulled in by another package, not declared directly in a manifest. undici vulnerable to HTTP h…
code-review-graph-vscode/package-lock.json ScaOsvGhsa p88m 4jfj 68fv
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency undici 7.24.4: GHSA-pr7r-676h-xcf6
OSV.dev reports `undici` at version `7.24.4` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-pr7r-676h-xcf6 (aka CVE-2026-9678). Note: `undici` is a transitive dependency — pulled in by another package, not declared directly in a manifest. undici vulnerable to cross-…
code-review-graph-vscode/package-lock.json ScaOsvGhsa pr7r 676h xcf6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency urllib3 2.6.3: GHSA-mf9v-mfxr-j63j
OSV.dev reports `urllib3` at version `2.6.3` (resolved in `uv.lock`) is affected by GHSA-mf9v-mfxr-j63j. Note: `urllib3` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-mf9v-mfxr…
uv.lock ScaOsvGhsa mf9v mfxr j63j
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency urllib3 2.6.3: GHSA-qccp-gfcp-xxvc
OSV.dev reports `urllib3` at version `2.6.3` (resolved in `uv.lock`) is affected by GHSA-qccp-gfcp-xxvc. Note: `urllib3` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-qccp-gfcp…
uv.lock ScaOsvGhsa qccp gfcp xxvc
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency urllib3 2.6.3: PYSEC-2026-141
OSV.dev reports `urllib3` at version `2.6.3` (resolved in `uv.lock`) is affected by PYSEC-2026-141. Note: `urllib3` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-141 Fix:…
uv.lock ScaOsvPysec 2026 141
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency urllib3 2.6.3: PYSEC-2026-142
OSV.dev reports `urllib3` at version `2.6.3` (resolved in `uv.lock`) is affected by PYSEC-2026-142. Note: `urllib3` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/PYSEC-2026-142 Fix:…
uv.lock ScaOsvPysec 2026 142
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency uuid 8.3.2: GHSA-w5hq-g745-h8pq
OSV.dev reports `uuid` at version `8.3.2` (resolved in `code-review-graph-vscode/package-lock.json`) is affected by GHSA-w5hq-g745-h8pq. Note: `uuid` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev…
code-review-graph-vscode/package-lock.json ScaOsvGhsa w5hq g745 h8pq
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/1b294954-6950-44e6-b360-a37840e0669d/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/1b294954-6950-44e6-b360-a37840e0669d/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.