Leaderboard github.com
Graphify-Labs/graphify
Turn any codebase, with its docs, SQL schemas, configs, and PDFs, into a queryable knowledge graph. A /graphify skill for Claude Code, Cursor, Codex, and Gemini CLI: local deterministic AST parsing, every edge explained, no vector store.
AI provenance
48%
explicit
- Confidence
- 95%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
65/100
weak
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
60/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
48% explicit
Explicit AI attribution on 48% of first-party code added; an estimated 48% including velocity signals.
How the score is built
- Explicitly attributed share48%
- Unattributed share in AI-pace bursts5%
- Estimated AI-generated share48%
- AI tool configuration files2
- Work sessions at AI pace10
- Releases at AI pace5
- Coding-style index (1.0+ means possible)0.09
Attributed AI tools
| Tool | Commits | Lines added | First seen | Last seen |
|---|---|---|---|---|
| Claude Code | 1,451 | 145,399 | 2026-04-07 | 2026-11-12 |
| Cursor agent | 18 | 2,641 | 2026-05-11 | 2026-11-11 |
| OpenAI Codex | 20 | 1,668 | 2026-05-05 | 2026-11-04 |
| Devin | 3 | 601 | 2026-05-26 | 2026-10-27 |
| Gemini CLI / Code Assist | 1 | 53 | 2026-10-27 | 2026-10-27 |
Lines added per month all AI-attributed share
- 2026-0423,264 · 28% AI
- 2026-0537,663 · 45% AI
- 2026-0634,559 · 78% AI
- 2026-0752,548 · 68% AI
- 2026-0838,245 · 47% AI
- 2026-0934,331 · 26% AI
- 2026-1067,812 · 40% AI
- 2026-1124,003 · 39% AI
Findings in AI-attributed lines vs the rest
From git blame: 57,058 lines trace to AI-attributed commits, 48,045 to others. Reported, not scored.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Code quality | 2.17 | 0.77 | 2.82× |
| Security | 0.53 | 0.48 | 1.10× |
Evidence by analyzer
Explicit AI attributionok30 items
- Claude Code: 1451 attributed commits, 145,399 lines added
- OpenAI Codex: 20 attributed commits, 1,668 lines added
- Cursor agent: 18 attributed commits, 2,641 lines added
- Devin: 3 attributed commits, 601 lines added
- Gemini CLI / Code Assist: 1 attributed commits, 53 lines added
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Cursor agent: trailer 'Co-Authored-By: Cursor'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- Claude Code: trailer 'Co-Authored-By: Claude'
- attributed_commit_share
- 50.1%
- attributed_commits
- 1,484
- attributed_loc
- 148,591
- attributed_loc_share
- 47.6%
- commits
- 2,960
- effective_loc
- 312,425
- tools_detected
- 5
AI tool configurationok2 items
- artifacts
- 2
- earliest_adoption
- 2026-04-14
- tools_configured
- 2
- workflow_agents
- 0
Commit velocityok10 items
- 14,027 lines of first-party code in ~1.7h (8,166 lines/hour, 7 commit session)
- 1,173 lines of first-party code in ~1.0h (1,207 lines/hour, 4 commit session)
- 2,985 lines of first-party code in ~3.0h (1,006 lines/hour, 16 commit session)
- 2,611 lines of first-party code in ~3.4h (768 lines/hour, 2 commit session)
- 1,743 lines of first-party code in ~2.4h (725 lines/hour, 1 commit session)
- 2,591 lines of first-party code in ~4.0h (648 lines/hour, 5 commit session)
- 1,286 lines of first-party code in ~2.3h (567 lines/hour, 1 commit session)
- 2,042 lines of first-party code in ~4.0h (506 lines/hour, 2 commit session)
- 2,011 lines of first-party code in ~4.0h (503 lines/hour, 1 commit session)
- 2,169 lines of first-party code in ~4.3h (500 lines/hour, 6 commit session)
- excluded_import_loc
- 2,334
- flagged_loc
- 32,638
- flagged_loc_share
- 10.5%
- flagged_units
- 10
- max_loc_per_hour
- 8,165.78
- measured_loc
- 310,091
- median_loc_per_hour
- 64.65
- pr_timed_units
- 57
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 1,336
Release velocityok5 items
- v0.9.10 → v0.9.11: 17,215 lines in 0.56 days (30,741.7 lines/day)
- v0.9.86 → v0.9.87: 5,077 lines in 0.73 days (6,910.5 lines/day)
- v0.9.101 → v0.9.102: 6,150 lines in 1.14 days (5,407.3 lines/day)
- v0.9.104 → v0.9.105: 5,839 lines in 1.73 days (3,375.8 lines/day)
- v0.9.105 → v0.9.106: 5,131 lines in 1.2 days (4,275.6 lines/day)
- flagged_releases
- 5
- max_loc_per_day
- 30,741.70
- releases
- 99
Coding styleok7 items
- step-by-step narration comment: # Step 1: Build a directed file-level graph from import/re-export edges.
- step-by-step narration comment: # Step 2: Find simple cycles, bounded by length.
- step-by-step narration comment: # Step 3: Sort by length (shortest = tightest coupling), then deduplicate.
- step-by-step narration comment: # first, so the dated folder held the NEW report, not the previous (#2402).
- step-by-step narration comment: # first, and which file kept it depended on processing order.
- step-by-step narration comment: # Step 2: path proximity over the survivors.
- step-by-step narration comment: # first, then top level (a leading `::` pins it to top level). A qualified
- count:assistant_voice
- 0
- count:emoji_in_code
- 0
- count:narrated_steps
- 7
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 0
- files:narrated_steps
- 5
- files:placeholder
- 0
- index
- 0.09
- lines_scanned
- 79,140
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0
- per_kloc:narrated_steps
- 0.09
- per_kloc:placeholder
- 0
Findings in AI-written linesok
- ai_lines
- 57,058
- blame_failures
- 0
- files_blamed
- 118
- other_lines
- 48,045
- quality:ai_findings
- 124
- quality:ai_per_kloc
- 2.17
- quality:other_findings
- 37
- quality:other_per_kloc
- 0.77
- quality:ratio
- 2.82
- security:ai_findings
- 30
- security:ai_per_kloc
- 0.53
- security:other_findings
- 23
- security:other_per_kloc
- 0.48
- security:ratio
- 1.10
Code quality
65 weak
Code quality is weak: test-to-source ratio 1.61, CI runs tests; 57% of function code in complex or long functions; 5% duplicated lines. Weakest area: complexity.
How the score is built
- Complexity18
- Duplication73
- Lint and smells63
- Tests and CI90
- Documentation100
- Type safety40
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- dispatch_command in graphify/cli.py: complexity 1012, 3308 lines
- _extract_generic.walk in graphify/extractors/engine.py: complexity 927, 1986 lines
- extract in graphify/extract.py: complexity 529, 1178 lines
- _extract_generic.walk_calls in graphify/extractors/engine.py: complexity 472, 904 lines
- _rebuild_code in graphify/watch.py: complexity 227, 759 lines
- build_from_json in graphify/build.py: complexity 200, 394 lines
- _apply_symbol_resolution_facts in graphify/extractors/resolution.py: complexity 187, 499 lines
- _extract_generic in graphify/extractors/engine.py: complexity 166, 476 lines
- extract_solidity in graphify/extractors/solidity.py: complexity 165, 472 lines
- deduplicate_entities in graphify/dedup.py: complexity 139, 298 lines
- complex_functions
- 376
- function_nloc
- 65,942
- functions
- 2,647
- long_functions
- 86
- many_param_functions
- 57
- mean_ccn
- 10.31
- p90_ccn
- 20
- risky_nloc_share
- 57.4%
Duplication (jscpd)ok10 items
- 6+ duplicated lines: graphify/analyze.py:61 and worked/mixed-corpus/raw/analyze.py:6
- 6+ duplicated lines: graphify/analyze.py:362 and graphify/analyze.py:448
- 6+ duplicated lines: graphify/build.py:2591 and graphify/build.py:2605
- 6+ duplicated lines: graphify/cache.py:490 and graphify/cache.py:1300
- 6+ duplicated lines: graphify/callflow_html.py:1545 and graphify/callflow_html.py:1609
- 6+ duplicated lines: graphify/cli.py:458 and graphify/llm.py:3090
- 6+ duplicated lines: graphify/cli.py:675 and graphify/cli.py:852
- 6+ duplicated lines: graphify/cli.py:693 and graphify/detect.py:2890
- 6+ duplicated lines: graphify/cli.py:2732 and graphify/serve.py:2781
- 6+ duplicated lines: graphify/cli.py:5089 and graphify/watch.py:2754
- compared_lines
- 89,508
- duplicated_lines
- 4,758
- duplicated_share
- 5.3%
- files
- 118
Lintok
- category:best-practice
- 9
- category:correctness
- 21
- category:maintainability
- 131
- findings
- 161
- scanned_lines
- 105,103
- weighted_findings
- 197
Tests and CIok6 items
- CI config: .github/workflows/ci.yml
.github/workflows/ci.yml - CI config: .github/workflows/pr-management.yml
.github/workflows/pr-management.yml - CI config: .github/workflows/publish.yml
.github/workflows/publish.yml - CI config: .github/workflows/release-graph.yml
.github/workflows/release-graph.yml - CI config: .github/workflows/welcome.yml
.github/workflows/welcome.yml - CI runs tests (pytest, bun test)
- check:ci_present
- yes
- check:ci_runs_lint
- no
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- yes
- check:tests_cochange
- yes
- ci_files
- 5
- cochange_commits
- 222
- cochange_share
- 77.5%
- source_lines
- 105,103
- test_lines
- 169,047
- test_ratio
- 1.61
Documentationok4 items
- README.md
README.md - LICENSE
LICENSE - CONTRIBUTING.md
CONTRIBUTING.md - CHANGELOG.md
CHANGELOG.md
- check:changelog
- yes
- check:contributing
- yes
- check:license
- yes
- check:readme
- yes
- readme_lines
- 383
Type safetyok
- check:low_escape_density
- yes
- check:strict_config
- no
- escapes
- 287
- escapes_per_kloc
- 2.73
Security
60 weak
Security posture is weak: 65 known vulnerabilities in 5 dependencies; 16 high-severity SAST findings; 25 high-severity workflow issues. Weakest area: ci actions.
How the score is built
- Secrets88
- Static analysis (SAST)90
- Vulnerable dependencies50
- CI workflows1
- Security posture40
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 78
- declared
- 78
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 2
- secrets_nonprod
- 2
Static analysis (opengrep)ok
- findings
- 53
- findings_high
- 16
- findings_low
- 0
- findings_medium
- 37
- parse_errors
- 0
- scanned_lines
- 105,103
- weighted_findings
- 30
Dependencies (osv-scanner)ok
- penalty
- 42
- vulnerabilities
- 65
- vulnerable_packages
- 5
- vulns_critical
- 6
- vulns_high
- 30
- vulns_low
- 4
- vulns_medium
- 24
- vulns_unknown
- 1
CI workflows (zizmor)ok
- findings
- 37
- findings_high
- 25
- findings_low
- 6
- findings_medium
- 6
- penalty
- 288.30
- workflows
- 5
Security postureok2 items
- Security policy: SECURITY.md
SECURITY.md - graphify/pi/package.json has no lockfile alongside it (unpinned dependencies)
graphify/pi/package.json
- check:dependency_updates
- no
- check:lockfiles
- no
- check:security_policy
- yes
- check:signed_commits
- no
- signed_commit_share
- 0.0%
- unpinned_manifests
- 1
Release downloadsok5 items
- release v0.9.108 ships graphify-self-graph.tar.gz (68 downloads)
- release v0.9.108 ships graphifyy-0.9.108.tar.gz (98 downloads)
- release v0.9.107 ships graphifyy-0.9.107.tar.gz (89 downloads)
- release v0.9.106 ships graphify-self-graph.tar.gz (51 downloads)
- release v0.9.106 ships graphifyy-0.9.106.tar.gz (57 downloads)
- binary_assets
- 19
- signals
- 1
- suspicious
- 0
Findings
6 critical89 high211 medium13 low1 info
320 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| critical | osv/GHSA-332p-7hrc-92wf |
uv.lock | [email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf | Dependencies (osv-scanner) |
| critical | osv/GHSA-5x8w-8jj5-q52h |
uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h | Dependencies (osv-scanner) |
| critical | osv/GHSA-8g5g-8vmr-9782 |
uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782 | Dependencies (osv-scanner) |
| critical | osv/GHSA-v9pv-5gc8-w2m6 |
uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4339, GHSA-v9pv-5gc8-w2m6 | Dependencies (osv-scanner) |
| critical | osv/GHSA-w889-685w-c8fh |
uv.lock | [email protected] (PyPI) is affected by GHSA-w889-685w-c8fh | Dependencies (osv-scanner) |
| critical | osv/GHSA-xvh5-g6gv-559v |
uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v | Dependencies (osv-scanner) |
| high | opengrep/python.lang.correctness.return-in-init |
graphify/cpp_resolution.py:66 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.identical-is-comparison |
graphify/detect.py:1903 | Found identical comparison using is. Ensure this is what you intended. | Lint |
| high | opengrep/python.lang.correctness.list-modify-while-iterate |
graphify/extract.py:8402 | It appears that `all_edges` is a list that is being modified while in a for loop. This will likely cause a runtime error or an infinite loop. | Lint |
| high | opengrep/python.lang.correctness.return-in-init |
graphify/extractors/csharp.py:388 | `return` should never appear inside a class __init__ function. This will cause a runtime error. | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
graphify/extractors/objc.py:155 | function `_get_name` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.correctness.list-modify-while-iterate |
graphify/extractors/resolution.py:3794 | It appears that `pending` is a list that is being modified while in a for loop. This will likely cause a runtime error or an infinite loop. | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
graphify/extractors/solidity.py:1003 | function `call_receiver` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
graphify/google_workspace.py:219 | Using 'tmp.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'tmp.name' is used. Use '.flush()' or close the file before using 'tmp.name'. | Lint |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
graphify/google_workspace.py:232 | Using 'tmp.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'tmp.name' is used. Use '.flush()' or close the file before using 'tmp.name'. | Lint |
| high | opengrep/python.lang.correctness.tempfile.tempfile-without-flush |
graphify/google_workspace.py:247 | Using 'tmp.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'tmp.name' is used. Use '.flush()' or close the file before using 'tmp.name'. | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
graphify/install.py:125 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
graphify/install.py:135 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
graphify/llm.py:2959 | function `_save_checkpoint` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.best-practice.open-never-closed |
graphify/serve.py:2835 | file object opened without corresponding close | Lint |
| high | opengrep/python.lang.maintainability.useless-inner-function |
graphify/serve.py:3249 | function `_build_commit_line` is defined inside a function but never used | Lint |
| high | opengrep/python.lang.correctness.common-mistakes.identical-is-comparison |
graphify/watch.py:1215 | Found identical comparison using is. Ensure this is what you intended. | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
graphify/watch.py:3820 | time.sleep() call; did you mean to leave this in? | Lint |
| high | opengrep/python.lang.best-practice.arbitrary-sleep |
graphify/watch.py:388 | time.sleep() call; did you mean to leave this in? | Lint |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:113 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:116 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:19 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:28 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:56 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:64 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:86 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:89 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/ci.yml:94 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/pr-management.yml:14 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/excessive-permissions |
.github/workflows/pr-management.yml:18 | overly broad permissions [confidence high] | CI workflows (zizmor) |
| high | zizmor/excessive-permissions |
.github/workflows/pr-management.yml:19 | overly broad permissions [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/pr-management.yml:27 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/pr-management.yml:50 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/publish.yml:32 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/publish.yml:35 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/publish.yml:35 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/publish.yml:55 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release-graph.yml:15 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/cache-poisoning |
.github/workflows/release-graph.yml:18 | runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release-graph.yml:18 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release-graph.yml:54 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/release-graph.yml:60 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/dangerous-triggers |
.github/workflows/welcome.yml:12 | use of fundamentally insecure workflow trigger [confidence medium] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/welcome.yml:23 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
graphify/__main__.py:402 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
graphify/__main__.py:804 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-os-exec-audit |
graphify/__main__.py:805 | Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low] | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
graphify/cli.py:1950 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
graphify/cli.py:1960 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
graphify/extract.py:10513 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
graphify/extract.py:9808 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
graphify/extract.py:9913 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
graphify/extract.py:9992 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
graphify/google_workspace.py:144 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
graphify/install.py:2926 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
graphify/llm.py:1889 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
graphify/llm.py:2005 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
graphify/llm.py:3309 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.use-defused-xml |
graphify/manifest_ingest.py:19 | The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause... | Static analysis (opengrep) |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit |
graphify/prs.py:714 | Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external... | Static analysis (opengrep) |
| high | osv/GHSA-22hg-r758-rrw9 |
uv.lock | [email protected] (PyPI) is affected by GHSA-22hg-r758-rrw9 | Dependencies (osv-scanner) |
| high | osv/GHSA-27h8-gf7j-v5hc |
uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc | Dependencies (osv-scanner) |
| high | osv/GHSA-3j72-p6qg-6xp7 |
uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4341, GHSA-3j72-p6qg-6xp7 | Dependencies (osv-scanner) |
| high | osv/GHSA-4558-3h8r-v8xp |
uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp | Dependencies (osv-scanner) |
| high | osv/GHSA-4rr5-89j8-mwwm |
uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4328, GHSA-4rr5-89j8-mwwm | Dependencies (osv-scanner) |
| high | osv/GHSA-58r4-6rv3-gfh8 |
uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4329, GHSA-58r4-6rv3-gfh8 | Dependencies (osv-scanner) |
| high | osv/GHSA-5xm2-6676-qcp9 |
uv.lock | [email protected] (PyPI) is affected by GHSA-5xm2-6676-qcp9 | Dependencies (osv-scanner) |
| high | osv/GHSA-65qm-jvmh-6pqg |
uv.lock | [email protected] (PyPI) is affected by GHSA-65qm-jvmh-6pqg | Dependencies (osv-scanner) |
| high | osv/GHSA-6655-6qjp-jx7x |
uv.lock | [email protected] (PyPI) is affected by GHSA-6655-6qjp-jx7x | Dependencies (osv-scanner) |
| high | osv/GHSA-78g4-xqwv-q3g8 |
uv.lock | [email protected] (PyPI) is affected by GHSA-78g4-xqwv-q3g8 | Dependencies (osv-scanner) |
| high | osv/GHSA-7mwm-ghpf-9vrm |
uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4331, GHSA-7mwm-ghpf-9vrm | Dependencies (osv-scanner) |
| high | osv/GHSA-9v9v-9qvf-h2hj |
uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4343, GHSA-9v9v-9qvf-h2hj | Dependencies (osv-scanner) |
| high | osv/GHSA-c6hw-5grf-ff96 |
uv.lock | [email protected] (PyPI) is affected by GHSA-c6hw-5grf-ff96 | Dependencies (osv-scanner) |
| high | osv/GHSA-cp9v-662q-vvx9 |
uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4333, GHSA-cp9v-662q-vvx9 | Dependencies (osv-scanner) |
| high | osv/GHSA-f2g6-542v-9j58 |
uv.lock | [email protected] (PyPI) is affected by GHSA-f2g6-542v-9j58 | Dependencies (osv-scanner) |
| high | osv/GHSA-g4qv-2jxx-769h |
uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4342, GHSA-g4qv-2jxx-769h | Dependencies (osv-scanner) |
| high | osv/GHSA-g7cr-3p24-7wf7 |
uv.lock | [email protected] (PyPI) is affected by GHSA-g7cr-3p24-7wf7 | Dependencies (osv-scanner) |
| high | osv/GHSA-g842-9rc4-69pw |
uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4338, GHSA-g842-9rc4-69pw | Dependencies (osv-scanner) |
| high | osv/GHSA-gg2r-wvfm-q9rx |
uv.lock | [email protected] (PyPI) is affected by GHSA-gg2r-wvfm-q9rx | Dependencies (osv-scanner) |
| high | osv/GHSA-j4m9-6w36-pw47 |
uv.lock | [email protected] (PyPI) is affected by GHSA-j4m9-6w36-pw47 | Dependencies (osv-scanner) |
| high | osv/GHSA-jg86-v3jv-hrpm |
uv.lock | [email protected] (PyPI) is affected by GHSA-jg86-v3jv-hrpm | Dependencies (osv-scanner) |
| high | osv/GHSA-mmhr-3c5m-f64f |
uv.lock | [email protected] (PyPI) is affected by GHSA-mmhr-3c5m-f64f | Dependencies (osv-scanner) |
| high | osv/GHSA-mmhr-3c5m-f64f |
uv.lock | [email protected] (PyPI) is affected by GHSA-mmhr-3c5m-f64f | Dependencies (osv-scanner) |
| high | osv/GHSA-mrfp-p49p-3hf2 |
uv.lock | [email protected] (PyPI) is affected by GHSA-mrfp-p49p-3hf2 | Dependencies (osv-scanner) |
| high | osv/GHSA-p4wg-p73j-c528 |
uv.lock | [email protected] (PyPI) is affected by GHSA-p4wg-p73j-c528 | Dependencies (osv-scanner) |
| high | osv/GHSA-pchr-8j38-3x4p |
uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4334, GHSA-pchr-8j38-3x4p | Dependencies (osv-scanner) |
| high | osv/GHSA-q45j-58j2-45rg |
uv.lock | [email protected] (PyPI) is affected by GHSA-q45j-58j2-45rg | Dependencies (osv-scanner) |
| high | osv/GHSA-v4x8-3wr5-3wq8 |
uv.lock | [email protected] (PyPI) is affected by GHSA-v4x8-3wr5-3wq8 | Dependencies (osv-scanner) |
| high | osv/GHSA-xcvg-w56q-r89m |
uv.lock | [email protected] (PyPI) is affected by GHSA-xcvg-w56q-r89m | Dependencies (osv-scanner) |
| high | osv/GHSA-xgh8-jp6q-p5x8 |
uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4335, GHSA-xgh8-jp6q-p5x8 | Dependencies (osv-scanner) |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
graphify/diagnostics.py:384 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
graphify/diagnostics.py:389 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extract.py:1018 | Is "is_named" a function or an attribute? If it is a function, you may have meant child.is_named() because child.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extract.py:2119 | Is "is_error" a function or an attribute? If it is a function, you may have meant node.is_error() because node.is_error is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extract.py:2325 | Is "is_missing" a function or an attribute? If it is a function, you may have meant node.is_missing() because node.is_missing is always true. | Lint |
| medium | opengrep/python.lang.best-practice.manual-defaultdict-list-create |
graphify/extract.py:9155 | manually creating a defaultdict - use collections.defaultdict(list) | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1020 | Is "is_named" a function or an attribute? If it is a function, you may have meant child.is_named() because child.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1029 | Is "is_named" a function or an attribute? If it is a function, you may have meant child.is_named() because child.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:10432 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:10450 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1061 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1064 | Is "is_named" a function or an attribute? If it is a function, you may have meant node.is_named() because node.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1066 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1078 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:10812 | Is "is_named" a function or an attribute? If it is a function, you may have meant child.is_named() because child.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:10859 | Is "is_named" a function or an attribute? If it is a function, you may have meant call_arg.is_named() because call_arg.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:11438 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1147 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:11679 | Is "is_named" a function or an attribute? If it is a function, you may have meant child.is_named() because child.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:11751 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:12187 | Is "is_named" a function or an attribute? If it is a function, you may have meant child.is_named() because child.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:12251 | Is "is_named" a function or an attribute? If it is a function, you may have meant child.is_named() because child.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:123 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1286 | Is "is_named" a function or an attribute? If it is a function, you may have meant ch.is_named() because ch.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1295 | Is "is_named" a function or an attribute? If it is a function, you may have meant child.is_named() because child.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1361 | Is "is_named" a function or an attribute? If it is a function, you may have meant sub.is_named() because sub.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1363 | Is "is_named" a function or an attribute? If it is a function, you may have meant arg.is_named() because arg.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1373 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1376 | Is "is_named" a function or an attribute? If it is a function, you may have meant node.is_named() because node.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1378 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1404 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1411 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:144 | Is "is_named" a function or an attribute? If it is a function, you may have meant sub.is_named() because sub.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:155 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:159 | Is "is_named" a function or an attribute? If it is a function, you may have meant node.is_named() because node.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:161 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1770 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1783 | Is "is_named" a function or an attribute? If it is a function, you may have meant arg.is_named() because arg.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1799 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1802 | Is "is_named" a function or an attribute? If it is a function, you may have meant node.is_named() because node.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1804 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1840 | Is "is_named" a function or an attribute? If it is a function, you may have meant a.is_named() because a.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1865 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:1972 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:2047 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:2054 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:2148 | Is "is_named" a function or an attribute? If it is a function, you may have meant arg.is_named() because arg.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:2154 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:2163 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.best-practice.manual-defaultdict-list-create |
graphify/extractors/engine.py:2475 | manually creating a defaultdict - use collections.defaultdict(list) | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:254 | Is "is_named" a function or an attribute? If it is a function, you may have meant a.is_named() because a.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:2985 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:3811 | Is "is_named" a function or an attribute? If it is a function, you may have meant child.is_named() because child.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:4474 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:4481 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:4484 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:499 | Is "is_named" a function or an attribute? If it is a function, you may have meant arg.is_named() because arg.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:504 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:518 | Is "is_named" a function or an attribute? If it is a function, you may have meant node.is_named() because node.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:520 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:5684 | Is "is_named" a function or an attribute? If it is a function, you may have meant node.is_named() because node.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:5688 | Is "is_named" a function or an attribute? If it is a function, you may have meant child.is_named() because child.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:5832 | Is "is_named" a function or an attribute? If it is a function, you may have meant grand.is_named() because grand.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:6172 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:6198 | Is "is_missing" a function or an attribute? If it is a function, you may have meant node.is_missing() because node.is_missing is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:6294 | Is "is_named" a function or an attribute? If it is a function, you may have meant child.is_named() because child.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:6330 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:6347 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:6354 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:6471 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:6747 | Is "is_named" a function or an attribute? If it is a function, you may have meant child.is_named() because child.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:676 | Is "is_named" a function or an attribute? If it is a function, you may have meant arg.is_named() because arg.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:6761 | Is "is_named" a function or an attribute? If it is a function, you may have meant child.is_named() because child.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:683 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:688 | Is "is_named" a function or an attribute? If it is a function, you may have meant node.is_named() because node.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:690 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:7356 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:7634 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:7767 | Is "is_named" a function or an attribute? If it is a function, you may have meant arg.is_named() because arg.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:7866 | Is "is_named" a function or an attribute? If it is a function, you may have meant inner.is_named() because inner.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:8027 | Is "is_named" a function or an attribute? If it is a function, you may have meant _a.is_named() because _a.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:8074 | Is "is_named" a function or an attribute? If it is a function, you may have meant arg.is_named() because arg.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:8126 | Is "is_named" a function or an attribute? If it is a function, you may have meant sub.is_named() because sub.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:8135 | Is "is_named" a function or an attribute? If it is a function, you may have meant tid.is_named() because tid.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:8144 | Is "is_named" a function or an attribute? If it is a function, you may have meant tid.is_named() because tid.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:8179 | Is "is_named" a function or an attribute? If it is a function, you may have meant child.is_named() because child.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:8396 | Is "is_named" a function or an attribute? If it is a function, you may have meant arg.is_named() because arg.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:8458 | Is "is_named" a function or an attribute? If it is a function, you may have meant sc.is_named() because sc.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:8472 | Is "is_named" a function or an attribute? If it is a function, you may have meant sc.is_named() because sc.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:8853 | Is "is_named" a function or an attribute? If it is a function, you may have meant child.is_named() because child.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:8860 | Is "is_named" a function or an attribute? If it is a function, you may have meant sub.is_named() because sub.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/engine.py:8987 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/go.py:146 | Is "is_named" a function or an attribute? If it is a function, you may have meant arg.is_named() because arg.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/go.py:152 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/go.py:155 | Is "is_named" a function or an attribute? If it is a function, you may have meant node.is_named() because node.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/go.py:157 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/go.py:187 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/go.py:250 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/go.py:259 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/go.py:431 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/go.py:690 | Is "is_named" a function or an attribute? If it is a function, you may have meant fc.is_named() because fc.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/go.py:745 | Is "is_named" a function or an attribute? If it is a function, you may have meant sub.is_named() because sub.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/objc.py:333 | Is "is_named" a function or an attribute? If it is a function, you may have meant token.is_named() because token.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/objc.py:341 | Is "is_missing" a function or an attribute? If it is a function, you may have meant token.is_missing() because token.is_missing is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/pascal.py:699 | Is "is_named" a function or an attribute? If it is a function, you may have meant child.is_named() because child.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/pascal.py:707 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/resolution.py:2316 | Is "is_named" a function or an attribute? If it is a function, you may have meant child.is_named() because child.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/resolution.py:2332 | Is "is_named" a function or an attribute? If it is a function, you may have meant child.is_named() because child.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/resolution.py:2366 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/resolution.py:2395 | Is "is_named" a function or an attribute? If it is a function, you may have meant sub.is_named() because sub.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/resolution.py:2398 | Is "is_named" a function or an attribute? If it is a function, you may have meant node.is_named() because node.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/resolution.py:2400 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/resolution.py:2837 | Is "is_named" a function or an attribute? If it is a function, you may have meant child.is_named() because child.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/rust.py:101 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/rust.py:104 | Is "is_named" a function or an attribute? If it is a function, you may have meant node.is_named() because node.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/rust.py:106 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/rust.py:605 | Is "is_named" a function or an attribute? If it is a function, you may have meant sub.is_named() because sub.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/rust.py:96 | Is "is_named" a function or an attribute? If it is a function, you may have meant arg.is_named() because arg.is_named is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/extractors/terraform.py:330 | Is "is_named" a function or an attribute? If it is a function, you may have meant c.is_named() because c.is_named is always true. | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
graphify/llm.py:1025 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/llm.py:3474 | Is "is_link_local" a function or an attribute? If it is a function, you may have meant ip.is_link_local() because ip.is_link_local is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/prs.py:111 | Is "is_draft" a function or an attribute? If it is a function, you may have meant pr.is_draft() because pr.is_draft is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/prs.py:490 | Is "is_draft" a function or an attribute? If it is a function, you may have meant pr.is_draft() because pr.is_draft is always true. | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
graphify/reflect.py:452 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
graphify/reflect.py:458 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
graphify/reflect.py:496 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
graphify/reflect.py:503 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/security.py:100 | Is "is_unspecified" a function or an attribute? If it is a function, you may have meant ip.is_unspecified() because ip.is_unspecified is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/security.py:95 | Is "is_private" a function or an attribute? If it is a function, you may have meant ip.is_private() because ip.is_private is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/security.py:96 | Is "is_reserved" a function or an attribute? If it is a function, you may have meant ip.is_reserved() because ip.is_reserved is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/security.py:97 | Is "is_loopback" a function or an attribute? If it is a function, you may have meant ip.is_loopback() because ip.is_loopback is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/security.py:98 | Is "is_link_local" a function or an attribute? If it is a function, you may have meant ip.is_link_local() because ip.is_link_local is always true. | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/security.py:99 | Is "is_multicast" a function or an attribute? If it is a function, you may have meant ip.is_multicast() because ip.is_multicast is always true. | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
graphify/serve.py:2835 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
graphify/serve.py:3039 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
graphify/serve.py:3058 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
graphify/serve.py:3073 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
graphify/serve.py:3089 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.correctness.common-mistakes.string-concat-in-list |
graphify/serve.py:3181 | Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list? | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
graphify/watch.py:3654 | Is "is_directory" a function or an attribute? If it is a function, you may have meant event.is_directory() because event.is_directory is always true. | Lint |
| medium | opengrep/python.lang.maintainability.return-not-in-function |
scripts/gen_demo_path.py:173 | `return` only makes sense inside a function | Lint |
| medium | opengrep/python.lang.best-practice.unspecified-open-encoding |
worked/example/raw/parser.py:14 | Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding="utf-8"). | Lint |
| medium | opengrep/python.lang.maintainability.is-function-without-parentheses |
worked/httpx/raw/models.py:106 | Is "is_error" a function or an attribute? If it is a function, you may have meant self.is_error() because self.is_error is always true. | Lint |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:1 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:104 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:11 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:49 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/ci.yml:81 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/publish.yml:32 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | opengrep/python.lang.security.audit.non-literal-import |
graphify/__init__.py:28 | Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/_minhash.py:47 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/callflow_html.py:376 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/callflow_html.py:667 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/export.py:668 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.regex_dos |
graphify/extract.py:3293 | Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2.... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.regex_dos |
graphify/extract.py:3490 | Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2.... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.regex_dos |
graphify/extract.py:3532 | Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2.... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/extract.py:470 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/extractors/engine.py:1557 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/extractors/engine.py:27 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.non-literal-import |
graphify/extractors/engine.py:7067 | Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code. [confidence low] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/extractors/engine.py:7411 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/extractors/engine.py:7415 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/extractors/engine.py:8532 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/extractors/engine.py:8536 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/extractors/engine.py:8569 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/extractors/engine.py:9200 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/extractors/go.py:573 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.regex_dos |
graphify/extractors/markdown.py:58 | Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2.... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.regex_dos |
graphify/extractors/markdown.py:61 | Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2.... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.regex_dos |
graphify/extractors/markdown.py:67 | Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2.... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/extractors/resolution.py:1129 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/extractors/resolution.py:1312 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/extractors/rust.py:456 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.regex_dos |
graphify/extractors/verilog.py:68 | Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2.... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/ids.py:90 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
graphify/pi/index.ts:186 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/scip_ingest.py:338 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.regex_dos |
graphify/serve.py:1888 | Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2.... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.regex_dos |
graphify/serve.py:1909 | Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2.... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1 |
graphify/transcribe.py:63 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | osv/GHSA-24rc-8hj2-v98c |
uv.lock | [email protected] (PyPI) is affected by GHSA-24rc-8hj2-v98c | Dependencies (osv-scanner) |
| medium | osv/GHSA-254f-3936-288h |
uv.lock | [email protected] (PyPI) is affected by GHSA-254f-3936-288h | Dependencies (osv-scanner) |
| medium | osv/GHSA-2g95-wg33-c5x2 |
uv.lock | [email protected] (PyPI) is affected by GHSA-2g95-wg33-c5x2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-462x-pgg6-55fp |
uv.lock | [email protected] (PyPI) is affected by GHSA-462x-pgg6-55fp | Dependencies (osv-scanner) |
| medium | osv/GHSA-4rm8-3hmm-39fg |
uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4340, GHSA-4rm8-3hmm-39fg | Dependencies (osv-scanner) |
| medium | osv/GHSA-654x-cwwv-5j9c |
uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4336, GHSA-654x-cwwv-5j9c | Dependencies (osv-scanner) |
| medium | osv/GHSA-6627-m3xw-93mp |
uv.lock | [email protected] (PyPI) is affected by GHSA-6627-m3xw-93mp | Dependencies (osv-scanner) |
| medium | osv/GHSA-69hj-f68j-2879 |
uv.lock | [email protected] (PyPI) is affected by GHSA-69hj-f68j-2879 | Dependencies (osv-scanner) |
| medium | osv/GHSA-74r2-7ff9-mjj2 |
uv.lock | [email protected] (PyPI) is affected by GHSA-74r2-7ff9-mjj2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-7g44-g9rc-x53w |
uv.lock | [email protected] (PyPI) is affected by GHSA-7g44-g9rc-x53w | Dependencies (osv-scanner) |
| medium | osv/GHSA-8mx5-7m5m-r77g |
uv.lock | [email protected] (PyPI) is affected by GHSA-8mx5-7m5m-r77g | Dependencies (osv-scanner) |
| medium | osv/GHSA-9c4x-gm8v-wgc4 |
uv.lock | [email protected] (PyPI) is affected by GHSA-9c4x-gm8v-wgc4 | Dependencies (osv-scanner) |
| medium | osv/GHSA-crv4-6mhj-j5jh |
uv.lock | [email protected] (PyPI) is affected by GHSA-crv4-6mhj-j5jh | Dependencies (osv-scanner) |
| medium | osv/GHSA-cwqr-hh33-gh44 |
uv.lock | [email protected] (PyPI) is affected by GHSA-cwqr-hh33-gh44 | Dependencies (osv-scanner) |
| medium | osv/GHSA-fc9g-5qg7-mf45 |
uv.lock | [email protected] (PyPI) is affected by GHSA-fc9g-5qg7-mf45 | Dependencies (osv-scanner) |
| medium | osv/GHSA-fj95-fr6c-h845 |
uv.lock | [email protected] (PyPI) is affected by GHSA-fj95-fr6c-h845 | Dependencies (osv-scanner) |
| medium | osv/GHSA-fq56-3cx3-fjxp |
uv.lock | [email protected] (PyPI) is affected by GHSA-fq56-3cx3-fjxp | Dependencies (osv-scanner) |
| medium | osv/GHSA-jqc4-5cvw-7w85 |
uv.lock | [email protected] (PyPI) is affected by GHSA-jqc4-5cvw-7w85 | Dependencies (osv-scanner) |
| medium | osv/GHSA-m462-7rxw-wvpg |
uv.lock | [email protected] (PyPI) is affected by GHSA-m462-7rxw-wvpg | Dependencies (osv-scanner) |
| medium | osv/GHSA-mf5v-w3w3-f6cg |
uv.lock | [email protected] (PyPI) is affected by GHSA-mf5v-w3w3-f6cg | Dependencies (osv-scanner) |
| medium | osv/GHSA-p8hx-v2p6-rp84 |
uv.lock | [email protected] (PyPI) is affected by PYSEC-2026-4337, GHSA-p8hx-v2p6-rp84 | Dependencies (osv-scanner) |
| medium | osv/GHSA-rfgq-q3w2-pmv2 |
uv.lock | [email protected] (PyPI) is affected by GHSA-rfgq-q3w2-pmv2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-rfpc-qcw5-3pc4 |
uv.lock | [email protected] (PyPI) is affected by GHSA-rfpc-qcw5-3pc4 | Dependencies (osv-scanner) |
| medium | osv/GHSA-vx6w-vv9f-6gvg |
uv.lock | [email protected] (PyPI) is affected by GHSA-vx6w-vv9f-6gvg | Dependencies (osv-scanner) |
| medium | osv/GHSA-wqgw-9xfh-qf2g |
uv.lock | [email protected] (PyPI) is affected by GHSA-wqgw-9xfh-qf2g | Dependencies (osv-scanner) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-md5 |
worked/httpx/raw/auth.py:85 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.audit.md5-used-as-password |
worked/httpx/raw/auth.py:89 | It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use... | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-md5 |
worked/httpx/raw/auth.py:89 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-md5 |
worked/httpx/raw/auth.py:90 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-md5 |
worked/httpx/raw/auth.py:91 | Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] | Static analysis (opengrep) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:113 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:19 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:56 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/ci.yml:86 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | zizmor/artipacked |
.github/workflows/release-graph.yml:15 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| low | gitleaks/generic-api-key |
scripts/run_k2_6_benchmark.py:11 | Possible generic-api-key secret in history (commit 10f1dda0e1); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/generic-api-key |
scripts/run_k2_6_largechunk.py:25 | Possible generic-api-key secret in history (commit 10f1dda0e1); removed from the current tree but still retrievable | Secrets (gitleaks) |
| low | gitleaks/private-key |
tests/test_security.py:504 | Possible private-key secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | gitleaks/jwt |
tests/test_security.py:505 | Possible jwt secret in the current tree (test/docs/example file) | Secrets (gitleaks) |
| low | osv/GHSA-567q-5qvw-pf92 |
uv.lock | [email protected] (PyPI) is affected by GHSA-567q-5qvw-pf92 | Dependencies (osv-scanner) |
| low | osv/GHSA-9j6q-wvj5-jgjg |
uv.lock | [email protected] (PyPI) is affected by GHSA-9j6q-wvj5-jgjg | Dependencies (osv-scanner) |
| low | osv/GHSA-9vhv-jxww-xfm5 |
uv.lock | [email protected] (PyPI) is affected by GHSA-9vhv-jxww-xfm5 | Dependencies (osv-scanner) |
| low | osv/GHSA-wfhq-q4j2-c37m |
uv.lock | [email protected] (PyPI) is affected by GHSA-wfhq-q4j2-c37m | Dependencies (osv-scanner) |
| info | zizmor/superfluous-actions |
.github/workflows/release-graph.yml:54 | action functionality is already included by the runner [confidence high] | CI workflows (zizmor) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | ok | prov-5 | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-5 | 0 | |
| Findings in AI-written lines | AI provenance | ok | git-blame | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 161 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 37 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 65 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 53 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 4 |
Score history
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | 52cb28218eea | prov-5+qual-2+sec-2 | 48% | 65 | 60 |
Full text report
- Repository: https://github.com/Graphify-Labs/graphify
- Commit:
52cb28218eea0c68d80a9f4b2ae102d2fa63e267 - Generated: 2026-11-14T15:44:20+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 48 | explicit | 95% | 100% |
| Code quality | 65 | weak | 90% | 100% |
| Security | 60 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 48% of first-party code added; an estimated 48% including velocity signals.
- Explicitly attributed share (lower bound): 47.6%
- Unattributed share in AI-consistent velocity bursts: 4.5%
- Estimated AI-generated share: 47.6%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 1,451 | 145,399 |
| OpenAI Codex | 20 | 1,668 |
| Cursor agent | 18 | 2,641 |
| Devin | 3 | 601 |
| Gemini CLI / Code Assist | 1 | 53 |
- AI tooling configured in repo: gemini, generic-agent
Current source lines last changed by AI-attributed commits: 57,058 of 105,103.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 2.173 | 0.77 | 2.82x |
| Security | 0.526 | 0.479 | 1.1x |
- Stylometry index: 0.09 per 1,000 lines (narrated steps 7, placeholders 0, assistant phrasing 0, emoji 0). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-04 | 23,264 | 28% |
| 2026-05 | 37,663 | 45% |
| 2026-06 | 34,559 | 78% |
| 2026-07 | 52,548 | 68% |
| 2026-08 | 38,245 | 47% |
| 2026-09 | 34,331 | 26% |
| 2026-10 | 67,812 | 40% |
| 2026-11 | 24,003 | 39% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (52cb28218eea)
- Claude Code: trailer 'Co-Authored-By: Claude' (5a48a18feeb7)
- Claude Code: trailer 'Co-Authored-By: Claude' (289b3f3c6062)
- Claude Code: trailer 'Co-Authored-By: Claude' (71356ad7cfe4)
- Claude Code: trailer 'Co-Authored-By: Claude' (c92662ef384e)
- Claude Code: trailer 'Co-Authored-By: Claude' (06aa51be0501)
- Claude Code: trailer 'Co-Authored-By: Claude' (221b93722c61)
- Claude Code: trailer 'Co-Authored-By: Claude' (a8f97f18f086)
- Claude Code: trailer 'Co-Authored-By: Claude' (65efa294e832)
- Claude Code: trailer 'Co-Authored-By: Claude' (78f65f6c7aeb)
- Claude Code: trailer 'Co-Authored-By: Claude' (85316831dfc3)
- Claude Code: trailer 'Co-Authored-By: Claude' (6487c68022b1)
- Claude Code: trailer 'Co-Authored-By: Claude' (1b1df068adab)
- Claude Code: trailer 'Co-Authored-By: Claude' (19014ae9d49f)
- Claude Code: trailer 'Co-Authored-By: Claude' (94167329ebbb)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is weak: test-to-source ratio 1.61, CI runs tests; 57% of function code in complex or long functions; 5% duplicated lines. Weakest area: complexity.
| Area | Score |
|---|---|
| Complexity (lizard) | 18 |
| Duplication | 73 |
| Code smells (Opengrep) | 63 |
| Tests and CI | 90 |
| Documentation | 100 |
| Type safety | 40 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 2,647; mean complexity 10.3, 90th percentile 20; 376 complex and 86 long functions
- Duplicated lines: 5.3% of 89,508 compared
- Tests: 169,047 test lines for 105,103 source lines (ratio 1.61); CI test commands: pytest, bun test; 77% of recent source commits also change tests
- Docs missing or thin: none
Most complex functions:
- dispatch_command in graphify/cli.py: complexity 1012, 3308 lines
- _extract_generic.walk in graphify/extractors/engine.py: complexity 927, 1986 lines
- extract in graphify/extract.py: complexity 529, 1178 lines
- _extract_generic.walk_calls in graphify/extractors/engine.py: complexity 472, 904 lines
- _rebuild_code in graphify/watch.py: complexity 227, 759 lines
Security
Security posture is weak: 65 known vulnerabilities in 5 dependencies; 16 high-severity SAST findings; 25 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 88 |
| Static analysis (Opengrep) | 90 |
| Vulnerable dependencies (OSV) | 50 |
| CI workflows (zizmor) | 1 |
| Posture (policy, updates, signing, lockfiles) | 40 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 65 in 5 packages (critical 6, high 30, medium 24, low 4)
-
Posture checks passed: security policy; missing: dependency updates, signed commits, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-5x8w-8jj5-q52h: [email protected] (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h |
uv.lock |
| critical | osv/GHSA-8g5g-8vmr-9782: [email protected] (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782 |
uv.lock |
| critical | osv/GHSA-v9pv-5gc8-w2m6: [email protected] (PyPI) is affected by PYSEC-2026-4339, GHSA-v9pv-5gc8-w2m6 |
uv.lock |
| critical | osv/GHSA-xvh5-g6gv-559v: [email protected] (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v |
uv.lock |
| critical | osv/GHSA-332p-7hrc-92wf: [email protected] (PyPI) is affected by GHSA-332p-7hrc-92wf |
uv.lock |
| critical | osv/GHSA-w889-685w-c8fh: [email protected] (PyPI) is affected by GHSA-w889-685w-c8fh |
uv.lock |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
graphify/main.py:402 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
graphify/main.py:804 |
| high | opengrep/python.lang.security.audit.dangerous-os-exec-audit: Found dynamic content when spawning a process. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Ensure no external data reaches here. [confidence low] |
graphify/main.py:805 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
graphify/cli.py:1950 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
graphify/cli.py:1960 |
| high | opengrep/python.lang.security.use-defused-xml: The Python documentation recommends using defusedxml instead of xml because the native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. [confidence low] |
graphify/extract.py:9808 |
| high | opengrep/python.lang.security.use-defused-xml: The Python documentation recommends using defusedxml instead of xml because the native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. [confidence low] |
graphify/extract.py:9913 |
| high | opengrep/python.lang.security.use-defused-xml: The Python documentation recommends using defusedxml instead of xml because the native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. [confidence low] |
graphify/extract.py:9992 |
| high | opengrep/python.lang.security.use-defused-xml: The Python documentation recommends using defusedxml instead of xml because the native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. [confidence low] |
graphify/extract.py:10513 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
graphify/google_workspace.py:144 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
graphify/install.py:2926 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
graphify/llm.py:1889 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
graphify/llm.py:2005 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
graphify/llm.py:3309 |
| high | opengrep/python.lang.security.use-defused-xml: The Python documentation recommends using defusedxml instead of xml because the native Python xml library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. [confidence low] |
graphify/manifest_ingest.py:19 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
graphify/prs.py:714 |
| high | osv/GHSA-v4x8-3wr5-3wq8: [email protected] (PyPI) is affected by GHSA-v4x8-3wr5-3wq8 |
uv.lock |
| high | osv/GHSA-27h8-gf7j-v5hc: [email protected] (PyPI) is affected by PYSEC-2026-4326, GHSA-27h8-gf7j-v5hc |
uv.lock |
| high | osv/GHSA-4558-3h8r-v8xp: [email protected] (PyPI) is affected by PYSEC-2026-4327, GHSA-4558-3h8r-v8xp |
uv.lock |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v0.9.108 ships graphify-self-graph.tar.gz (68 downloads)
- binary-release-asset: release v0.9.108 ships graphifyy-0.9.108.tar.gz (98 downloads)
- binary-release-asset: release v0.9.107 ships graphifyy-0.9.107.tar.gz (89 downloads)
- binary-release-asset: release v0.9.106 ships graphify-self-graph.tar.gz (51 downloads)
- binary-release-asset: release v0.9.106 ships graphifyy-0.9.106.tar.gz (57 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 105,103; test lines: 169,047
| Language | Lines |
|---|---|
| Python | 272,243 |
| TypeScript | 711 |
| PHP | 161 |
| SQL | 150 |
| C# | 126 |
| Swift | 94 |
| Rust | 93 |
| C++ | 90 |
| C | 79 |
| Objective-C | 63 |