← Back to scan
File as GitHub Issue repo: deepset-ai/haystack-core-integrations

Push this scan report to deepset-ai/haystack-core-integrations

Click the green button below to open GitHub’s new-issue form, pre-filled with the report title, summary table, top findings, and an embedded score-card image. No authentication needed — you review on GitHub before submitting. Repobility is credited as the scanner.

Embedded score card image

This image will render at the top of the issue body. Hosted on Repobility, refreshes automatically after re-scans.

Repobility score card

Issue title

Missing import: `operator` used but not imported

Curate findings to include

Pick exactly which findings appear in the issue body. By default the top 5 are included. Uncheck noise, check what matters.

Top 5 (default)
Severity Rule Title File:line
CRIT SEC022 [SEC022] Database URL With Embedded Credential: A database connection URL contains an emb… integrations/supabase/src/haystack_inte…:31
CRIT SEC022 [SEC022] Database URL With Embedded Credential: A database connection URL contains an emb… integrations/supabase/src/haystack_inte…:27
CRIT MINED107 Missing import: `operator` used but not imported integrations/falkordb/src/haystack_inte…:828
CRIT MINED107 Missing import: `string` used but not imported integrations/cohere/src/haystack_integr…:33
CRIT MINED107 Missing import: `operator` used but not imported integrations/arcadedb/src/haystack_inte…:29
CRIT DKC007 Compose service contains a literal secret environment value integrations/supabase/docker-compose.yml:15
CRIT DKC007 Compose service contains a literal secret environment value integrations/supabase/docker-compose.yml:1
CRIT DKC007 Compose service contains a literal secret environment value integrations/oracle/docker-compose.yml:1
CRIT DKC007 Compose service contains a literal secret environment value integrations/opensearch/docker-compose.…:1
CRIT curl-auth-header Discovered a potential authorization token provided in a curl command header, which could… .github/workflows/supabase.yml:137
CRIT jwt Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and… .github/workflows/supabase.yml:137
CRIT MINED116 Workflow uses `secrets.GOOGLE_API_KEY` on a `pull_request` trigger .github/workflows/google_genai.yml:32
CRIT MINED116 Workflow uses `secrets.SLACK_WEBHOOK_URL_NOTIFICATIONS` on a `pull_request` trigger .github/workflows/llama_stack.yml:212
CRIT MINED116 Workflow uses `secrets.SLACK_WEBHOOK_URL_NOTIFICATIONS` on a `pull_request` trigger .github/workflows/mcp.yml:155
CRIT MINED116 Workflow uses `secrets.OPENAI_API_KEY` on a `pull_request` trigger .github/workflows/mcp.yml:33
CRIT MINED116 Workflow uses `secrets.BRAVE_API_KEY` on a `pull_request` trigger .github/workflows/mcp.yml:32
CRIT MINED116 Workflow uses `secrets.SLACK_WEBHOOK_URL_NOTIFICATIONS` on a `pull_request` trigger .github/workflows/fastembed.yml:129
CRIT MINED116 Workflow uses `secrets.SLACK_WEBHOOK_URL_NOTIFICATIONS` on a `pull_request` trigger .github/workflows/weaviate.yml:139
CRIT MINED116 Workflow uses `secrets.SLACK_WEBHOOK_URL_NOTIFICATIONS` on a `pull_request` trigger .github/workflows/sqlalchemy.yml:128
CRIT MINED116 Workflow uses `secrets.SLACK_WEBHOOK_URL_NOTIFICATIONS` on a `pull_request` trigger .github/workflows/arcadedb.yml:147
CRIT MINED116 Workflow uses `secrets.ARCADEDB_PASSWORD` on a `pull_request` trigger .github/workflows/arcadedb.yml:70
CRIT MINED116 Workflow uses `secrets.ARCADEDB_PASSWORD` on a `pull_request` trigger .github/workflows/arcadedb.yml:30
CRIT MINED116 Workflow uses `secrets.SLACK_WEBHOOK_URL_NOTIFICATIONS` on a `pull_request` trigger .github/workflows/cohere.yml:142
CRIT MINED116 Workflow uses `secrets.COHERE_API_KEY` on a `pull_request` trigger .github/workflows/cohere.yml:32
CRIT MINED116 Workflow uses `secrets.SLACK_WEBHOOK_URL_NOTIFICATIONS` on a `pull_request` trigger .github/workflows/valkey.yml:147
CRIT MINED116 Workflow uses `secrets.SLACK_WEBHOOK_URL_NOTIFICATIONS` on a `pull_request` trigger .github/workflows/unstructured.yml:153
CRIT MINED116 Workflow uses `secrets.SLACK_WEBHOOK_URL_NOTIFICATIONS` on a `pull_request` trigger .github/workflows/firecrawl.yml:137
CRIT MINED116 Workflow uses `secrets.FIRECRAWL_API_KEY` on a `pull_request` trigger .github/workflows/firecrawl.yml:28
CRIT MINED116 Workflow uses `secrets.SLACK_WEBHOOK_URL_NOTIFICATIONS` on a `pull_request` trigger .github/workflows/paddleocr.yml:143
CRIT MINED116 Workflow uses `secrets.PADDLEOCR_VL_API_URL` on a `pull_request` trigger .github/workflows/paddleocr.yml:33
CRIT MINED116 Workflow uses `secrets.AISTUDIO_ACCESS_TOKEN` on a `pull_request` trigger .github/workflows/paddleocr.yml:32
CRIT MINED116 Workflow uses `secrets.SLACK_WEBHOOK_URL_NOTIFICATIONS` on a `pull_request` trigger .github/workflows/nvidia.yml:145
CRIT MINED116 Workflow uses `secrets.NVIDIA_CATALOG_API_KEY` on a `pull_request` trigger .github/workflows/nvidia.yml:33
CRIT MINED116 Workflow uses `secrets.NVIDIA_API_KEY` on a `pull_request` trigger .github/workflows/nvidia.yml:32
CRIT MINED116 Workflow uses `secrets.SLACK_WEBHOOK_URL_NOTIFICATIONS` on a `pull_request` trigger .github/workflows/falkordb.yml:154
CRIT MINED116 Workflow uses `secrets.SLACK_WEBHOOK_URL_NOTIFICATIONS` on a `pull_request` trigger .github/workflows/amazon_sagemaker.yml:141
HIGH MINED001 [MINED001] Bare Except Pass: except: pass or except Exception: pass — silently swallows e… integrations/weaviate/src/haystack_inte…:115
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… integrations/github/src/haystack_integr…:112
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… integrations/github/src/haystack_integr…:75
HIGH SEC029 [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTT… integrations/firecrawl/src/haystack_int…:92
HIGH SEC078 [SEC078] Python: requests without timeout: requests.get/post without a timeout will hang … integrations/google_ai/src/haystack_int…:54
HIGH SEC078 [SEC078] Python: requests without timeout: requests.get/post without a timeout will hang … integrations/github/src/haystack_integr…:119
HIGH SEC078 [SEC078] Python: requests without timeout: requests.get/post without a timeout will hang … .github/utils/validate_version.py:29
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … integrations/chonkie/src/haystack_integ…:108
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … integrations/brave/src/haystack_integra…:154
HIGH SEC128 [SEC128] Async function without await — fire-and-forget Promise (AI mistake): Async call … .github/utils/pyproject_to_requirements…:12
HIGH MINED004 [MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums). .github/utils/docstrings_checksum.py:30
HIGH MINED108 `self.filter_documents_async` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:870
HIGH MINED108 `self._ensure_initialized_async` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:866
HIGH MINED108 `self.filter_documents` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:828
HIGH MINED108 `self._ensure_initialized` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:824
HIGH MINED108 `self.filter_documents_async` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:781
HIGH MINED108 `self._ensure_initialized_async` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:774
HIGH MINED108 `self.filter_documents` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:733
HIGH MINED108 `self._ensure_initialized` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:726
HIGH MINED108 `self._ensure_initialized_async` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:713
HIGH MINED108 `self._ensure_initialized` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:700
HIGH MINED108 `self._apply_duplicate_policy` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:666
HIGH MINED108 `self._ensure_initialized_async` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:651
HIGH MINED108 `self._apply_duplicate_policy` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:612
HIGH MINED108 `self._ensure_initialized` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:598
HIGH MINED108 `self._ensure_initialized_async` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:446
HIGH MINED108 `self._get_result_to_documents` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:452
HIGH MINED108 `self._get_result_to_documents` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:432
HIGH MINED108 `self._ensure_initialized` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:426
HIGH MINED108 `self._ensure_initialized_async` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:410
HIGH MINED108 `self._ensure_initialized` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:398
HIGH MINED108 `self._async_client` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:189
HIGH MINED108 `self._client` used but never assigned in __init__ integrations/chroma/src/haystack_integr…:141
HIGH DKC013 Database service has no persistent data volume integrations/opensearch/docker-compose.…:1
HIGH DKC013 Database service has no persistent data volume integrations/elasticsearch/docker-compo…:1
HIGH MINED126 Workflow container/services image `pgvector/pgvector:pg17` unpinned .github/workflows/pgvector.yml:64
HIGH MINED126 Workflow container/services image `pgvector/pgvector:pg17` unpinned .github/workflows/supabase.yml:65
HIGH MINED126 Workflow container/services image `arcadedata/arcadedb:latest` unpinned .github/workflows/arcadedb.yml:67
HIGH MINED126 Workflow container/services image `valkey/valkey-bundle:latest` unpinned .github/workflows/valkey.yml:65
HIGH MINED126 Workflow container/services image `falkordb/falkordb:latest` unpinned .github/workflows/falkordb.yml:64
HIGH MINED118 Dockerfile FROM `postgres:17-bookworm` not pinned by digest integrations/supabase/Dockerfile.pgroon…:1
HIGH SEC020 [SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-b… integrations/anthropic/example/prompt_c…:89
HIGH DKC011 Database service publishes a host port integrations/oracle/docker-compose.yml:1
HIGH DKC011 Database service publishes a host port integrations/opensearch/docker-compose.…:1
HIGH DKC011 Database service publishes a host port integrations/elasticsearch/docker-compo…:1
MED SEC125 [SEC125] AI placeholder credential left in source (your-api-key-here style): AI coding as… integrations/huggingface_api/src/haysta…:44
MED MINED111 Bare except continues silently integrations/weaviate/src/haystack_inte…:1454
MED MINED111 Bare except continues silently integrations/weaviate/src/haystack_inte…:1360
MED MINED111 Bare except continues silently integrations/mcp/examples/mcp_client.py:43
MED MINED111 Bare except continues silently integrations/mcp/examples/mcp_stdio_too…:56
MED MINED111 Bare except continues silently integrations/mcp/examples/mcp_filtered_…:53
MED MINED111 Bare except continues silently integrations/mcp/examples/mcp_stdio_cli…:37
MED MINED111 Bare except continues silently integrations/mistral/src/haystack_integ…:428
MED COMP001 [COMP001] High cognitive complexity: Function `_prepare_api_call` has cognitive complexit… integrations/aimlapi/src/haystack_integ…:156
MED DKR003 Compose service `falkordb` image uses the latest tag integrations/falkordb/docker-compose.yml:1
MED DKR007 Docker build context has no .dockerignore .dockerignore
MED DEPCUR-PY Python package `openai` is 1 major version(s) behind (1.6.1 -> 2.41.0) integrations/astra/examples/requirement…:3
MED DEPCUR-PY Python package `sentence_transformers` is 3 major version(s) behind (2.2.2 -> 5.5.1) integrations/astra/examples/requirement…:2
MED MINED124 requirements.txt: `sentence-transformers` has no version pin integrations/langfuse/example/requireme…:3
MED MINED124 requirements.txt: `datasets` has no version pin integrations/langfuse/example/requireme…:2
MED MINED124 requirements.txt: `langfuse-haystack` has no version pin integrations/langfuse/example/requireme…:1
MED MINED124 requirements.txt: `haystack-ai` has no version pin integrations/astra/examples/requirement…:1
MED DKC014 Database data bind mount is inside the Docker build context integrations/oracle/docker-compose.yml:1
MED DKR001 Docker final stage has no non-root USER integrations/supabase/Dockerfile.pgroon…:1
MED DKC013 Database service has no persistent data volume integrations/supabase/docker-compose.yml:1
MED AGT015 Remote install command pipes network code directly to a shell .github/workflows/ollama.yml:75
MED AGT015 Remote install command pipes network code directly to a shell .github/workflows/llama_stack.yml:72
LOW COMP001 [COMP001] High cognitive complexity: Function `validate_version_number` has cognitive com… .github/utils/validate_version.py:9
LOW COMP001 [COMP001] High cognitive complexity: Function `docstrings_checksum` has cognitive complex… .github/utils/docstrings_checksum.py:7
LOW AIC003 Duplicated implementation block across source files integrations/elasticsearch/src/haystack…:78
LOW AIC003 Duplicated implementation block across source files integrations/elasticsearch/src/haystack…:74
LOW AIC003 Duplicated implementation block across source files integrations/elasticsearch/src/haystack…:73
LOW AIC003 Duplicated implementation block across source files integrations/elasticsearch/src/haystack…:67
LOW AIC003 Duplicated implementation block across source files integrations/elasticsearch/src/haystack…:79
LOW AIC003 Duplicated implementation block across source files integrations/cohere/src/haystack_integr…:19
LOW AIC003 Duplicated implementation block across source files integrations/cohere/src/haystack_integr…:17
LOW AIC003 Duplicated implementation block across source files integrations/cohere/src/haystack_integr…:33
LOW AIC003 Duplicated implementation block across source files integrations/chroma/src/haystack_integr…:110
LOW AIC003 Duplicated implementation block across source files integrations/chonkie/src/haystack_integ…:82
LOW AIC003 Duplicated implementation block across source files integrations/chonkie/src/haystack_integ…:80
LOW AIC003 Duplicated implementation block across source files integrations/chonkie/src/haystack_integ…:60
LOW AIC003 Duplicated implementation block across source files integrations/chonkie/src/haystack_integ…:102
LOW AIC003 Duplicated implementation block across source files integrations/chonkie/src/haystack_integ…:82
LOW AIC003 Duplicated implementation block across source files integrations/chonkie/src/haystack_integ…:108
LOW AIC003 Duplicated implementation block across source files integrations/azure_ai_search/src/haysta…:25
LOW AIC003 Duplicated implementation block across source files integrations/azure_ai_search/src/haysta…:45
LOW AIC003 Duplicated implementation block across source files integrations/astra/src/haystack_integra…:483
LOW AIC003 Duplicated implementation block across source files integrations/anthropic/src/haystack_int…:97
LOW AIC003 Duplicated implementation block across source files integrations/anthropic/src/haystack_int…:87
LOW AIC003 Duplicated implementation block across source files integrations/anthropic/src/haystack_int…:109
LOW AIC003 Duplicated implementation block across source files integrations/anthropic/src/haystack_int…:250
LOW AIC003 Duplicated implementation block across source files integrations/amazon_textract/src/haysta…:184
LOW AIC003 Duplicated implementation block across source files integrations/amazon_bedrock/src/haystac…:102
LOW AIC003 Duplicated implementation block across source files integrations/amazon_bedrock/src/haystac…:254
LOW AIC003 Duplicated implementation block across source files integrations/amazon_bedrock/src/haystac…:149
LOW AIC003 Duplicated implementation block across source files integrations/amazon_bedrock/src/haystac…:267
LOW AIC003 Duplicated implementation block across source files integrations/amazon_bedrock/src/haystac…:29
LOW AIC003 Duplicated implementation block across source files integrations/amazon_bedrock/src/haystac…:41
LOW AIC003 Duplicated implementation block across source files integrations/alloydb/src/haystack_integ…:60
LOW DKR011 Dockerfile installs recommended OS packages integrations/supabase/Dockerfile.pgroon…:3
LOW DKC010 Compose service lacks no-new-privileges hardening integrations/weaviate/docker-compose.yml:1
LOW DKC010 Compose service lacks no-new-privileges hardening integrations/vespa/docker-compose.yml:1
LOW DKC010 Compose service lacks no-new-privileges hardening integrations/oracle/docker-compose.yml:1
LOW DKC010 Compose service lacks no-new-privileges hardening integrations/falkordb/docker-compose.yml:1
LOW DKC006 Compose service does not declare a runtime user integrations/weaviate/docker-compose.yml:1
LOW DKC006 Compose service does not declare a runtime user integrations/vespa/docker-compose.yml:1
LOW DKC006 Compose service does not declare a runtime user integrations/supabase/docker-compose.yml:1
LOW DKC006 Compose service does not declare a runtime user integrations/oracle/docker-compose.yml:1
LOW DKC006 Compose service does not declare a runtime user integrations/falkordb/docker-compose.yml:1
INFO MINED064 [MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services. scripts/create_new_integration.py:65
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… integrations/nvidia/src/haystack_integr…:28
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… integrations/nvidia/src/haystack_integr…:60
INFO MINED043 [MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle cr… integrations/nvidia/src/haystack_integr…:64
INFO MINED074 [MINED074] Ai Tell Fake Citation: Plausible-looking but non-existent URLs (e.g., docs.exa… integrations/huggingface_api/src/haysta…:78
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… integrations/chroma/src/haystack_integr…:11
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… integrations/azure_ai_search/src/haysta…:7
INFO MINED050 [MINED050] Stub Only Function: Function declared but body is just pass, return None, rais… integrations/astra/src/haystack_integra…:11
INFO MINED055 [MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versi… integrations/e2b/examples/e2b_pipeline_…:18
INFO MINED055 [MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versi… integrations/e2b/examples/e2b_agent_exa…:13
INFO MINED055 [MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versi… integrations/arcadedb/examples/embeddin…:13
INFO MINED049 [MINED049] Print Pii: Logging password/token/email/ssn directly to stdout. integrations/mcp/examples/time_pipeline…:33
INFO MINED049 [MINED049] Print Pii: Logging password/token/email/ssn directly to stdout. integrations/llama_cpp/src/haystack_int…:28
INFO MINED049 [MINED049] Print Pii: Logging password/token/email/ssn directly to stdout. integrations/anthropic/example/prompt_c…:89
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. integrations/github/src/haystack_integr…:15
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. integrations/chroma/src/haystack_integr…:29
INFO MINED062 [MINED062] Python Dataclass No Fields: @dataclass over an empty class — unfinished model. integrations/amazon_bedrock/src/haystac…:17
INFO MINED067 [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang f… integrations/github/src/haystack_integr…:101
INFO MINED067 [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang f… integrations/github/src/haystack_integr…:108
INFO MINED067 [MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang f… .github/utils/validate_version.py:29
Reset to top 5 165 findings available (after auto-suppression of test files + won't-fix)

Issue body (markdown)

## Code-quality scan: `deepset-ai/haystack-core-integrations`

**Score: 63/100 (C+)**  ·  198 findings  ·  scanned 2026-06-05 13:26 UTC  ·  195,457 LOC

| Severity | Count |
|---|---|
| CRITICAL | 36 |
| HIGH | 45 |
| MEDIUM | 22 |
| LOW | 42 |

📊 [Full filterable report](https://repobility.com/scan/45850fae-6fe7-4e53-90fd-1a07f571b585/)  ·  ![scorecard](https://repobility.com/scan/45850fae-6fe7-4e53-90fd-1a07f571b585/report.png?v=1780665985-s2)

### Top findings

1. **CRITICAL** `SEC022` — Database URL With Embedded Credential
   `integrations/supabase/src/haystack_integrations/components/retrievers/supabase/keyword_retriever.py:31` · A07:2021 Identification & Authentication Failures
2. **CRITICAL** `SEC022` — Database URL With Embedded Credential
   `integrations/supabase/src/haystack_integrations/components/retrievers/supabase/embedding_retriever.py:27` · A07:2021 Identification & Authentication Failures
3. **CRITICAL** `MINED107` — Missing import: `operator` used but not imported
   `integrations/falkordb/src/haystack_integrations/document_stores/falkordb/document_store.py:828` · ✓ Repobility
4. **CRITICAL** `MINED107` — Missing import: `string` used but not imported
   `integrations/cohere/src/haystack_integrations/components/embedders/cohere/embedding_types.py:33` · ✓ Repobility
5. **CRITICAL** `MINED107` — Missing import: `operator` used but not imported
   `integrations/arcadedb/src/haystack_integrations/document_stores/arcadedb/filters.py:29` · ✓ Repobility

---

**Security note**: this issue is public. If any flagged finding is a real, exploitable vulnerability, please redirect to your `SECURITY.md` policy or open a [private security advisory](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) instead. We're happy to close this and re-submit privately.

---

_Filed automatically. Close this issue if not useful — we won't refile. Full report: https://repobility.com/scan/45850fae-6fe7-4e53-90fd-1a07f571b585/_
Already filed
This repo publishes a SECURITY.md policy and the scan contains 12 Critical/High security finding(s). Public issue filing would violate coordinated disclosure. Submit privately via the project's security reporting channel.
Megaproject â high spam risk
Could not determine 'deepset-ai/haystack-core-integrations' star count (GitHub API rate-limited or unreachable). When in doubt about repo size, prefer opening a focused PR or a discussion rather than an issue.
Already filed
89/213 findings (42%) on this scan are already flagged as test-file, won't-fix, or suppressed. The scan is too noisy to file as a single issue. Curate down to specific actionable findings, or address the FP source first.
I read the warnings â override Cancel

The button opens GitHubâs new-issue page in a new tab. You will see the title + body pre-filled â review, edit if you want, then click GitHubâs "Submit new issue" button. Repobility never posts anything on your behalf.

For real security findings on big repos: use the project's SECURITY.md or private advisory flow instead of a public issue.