Loading report…
← nittim
← nittimshared scan
pyca/cryptography ↗ · 4148c19 · Aug 22, 2026, 12:53 AM
No issues found
Free scan · deterministic evidence only
No deterministic issues found — not a clean bill of health. 14 dimensions remain unaudited. Run Audit for the verdict.
302 of 3046 files scanned (9%) — this snapshot was truncated: this audit's size limit was reached, so some source was left unread.
What this means
Two scanners read 302 of 3046 files, starting with the highest-priority ones: one for committed credentials, one for known vulnerabilities in your dependencies. Neither found anything. That is not a clean bill of health. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep AI is the tier that issues a verdict. This scan does not.
Read it:
Worth knowing, not blocking
advisoryGeneric hardcoded secretsrc/cryptography/hazmat/_oid.py:372
AttributeOID.CHALLENGE_PASSWO…ord", — non-production path
advisoryPrivate Key blocksrc/cryptography/hazmat/primitives/serialization/ssh.py:77
_SK_START = b"-----B…----" — non-production path
declared rangecrates.io self_cell2 in 1 version
1 — GHSA-48m6-wm5p-rr6h, RUSTSEC-2023-0070
Insufficient covariance check makes self_cell unsound — HIGH, declared range (not an installed version)
Insufficient covariance check makes self_cell unsound — UNKNOWN, declared range (not an installed version)
Published test vectors — not production secrets
test vectorPrivate Key block15 in 1 file
vectors/cryptography_vectors/asymmetric/ECDSA/RFC6979/evppkey_ecdsa_rfc6979.txt:18, :234, :450, :650, :851, :1053, :1269, :1469, :1669, :1870, :2072, :2287, :2486, :2686, :2887
:18 — -----B…---- — published test vector
:234 — -----B…---- — published test vector
:450 — -----B…---- — published test vector
:650 — -----B…---- — published test vector
:851 — -----B…---- — published test vector
:1053 — -----B…---- — published test vector
:1269 — -----B…---- — published test vector
:1469 — -----B…---- — published test vector
:1669 — -----B…---- — published test vector
:1870 — -----B…---- — published test vector
:2072 — -----B…---- — published test vector
:2287 — -----B…---- — published test vector
:2486 — -----B…---- — published test vector
:2686 — -----B…---- — published test vector
:2887 — -----B…---- — published test vector
AI audit · pyca/cryptography · 14 dimensions · usually within 15 minutes*
14 things unaudited
Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.
The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.
SecurityPriority: Core
Privacy & CompliancePriority: Core
Reliability & ResiliencePriority: Core
Code Quality & ArchitecturePriority: Important
AI / Vibe Coding RiskPriority: Important
Performance & ScalabilityPriority: Important
Infrastructure & DevOpsPriority: Important
Data LayerPriority: Important
Business & Product RiskPriority: Supporting
Developer ExperiencePriority: Supporting
Accessibility & UXPriority: Supporting
ObservabilityPriority: Supporting
Maintainability ForecastPriority: Specialized
IP & Novelty ExposurePriority: Specialized
Modules run (2)
Hardcoded Secret ScanDependency Vulnerability Scan
Scanned 302 of 3046 files (highest-priority subset) · pyca/cryptography
Dependency manifests: 2 Python manifests read; 1 Go manifest read; 11 Rust manifests read.
README badge
[](https://nittim.com/library/pyca/cryptography)