Loading report…
← nittim
← nittimshared scan
anxolerd/dvpwa ↗ · a1d8f89 · Aug 21, 2026, 11:10 PM
Hard evidence: 4 issues need attention now.
Free scan · deterministic evidence only
4 critical dependency vulnerabilities found. 11 more dimensions need Audit for the full picture.
33 of 58 files scanned (56%). Nothing was cut short by a limit — the rest is mostly images, generated output, and other non-source content this audit doesn't read.
What this means
Two scanners read 33 of 58 files: one for committed credentials, one for known vulnerabilities in your dependencies. They found 0 committed credentials on production paths and 4 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep AI is the tier that issues a verdict. This scan does not.
Read it:
Packages you ship with known vulnerabilities
cvePyPI pyyaml2 in 1 version
3.13 — GHSA-8q59-q68h-6hv4, GHSA-rprw-h62v-c2w7
Improper Input Validation in PyYAML — CRITICAL
PyYAML insecurely deserializes YAML strings leading to arbitrary code execution — CRITICAL
cvePyPI idna@2.8PYSEC-2024-60
A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, — CVSS CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cvePyPI jinja2@2.10GHSA-462w-v97r-4m45
Jinja2 sandbox escape via string formatting — HIGH
Worth knowing, not blocking
low cvePyPI aiohttp3 in 1 version
3.5.3 — GHSA-2fqr-mr3j-6wp8, GHSA-2vrm-gr82-f7m5, GHSA-3wq7-rqq7-wx6j
aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence — LOW
AIOHTTP has CRLF injection through multipart part content type header construction — LOW
AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS — LOW
moderate cvePyPI idna2 in 1 version
2.8 — GHSA-65pc-fj4g-8rjx, GHSA-jjg7-2v4v-x38h
Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix — MODERATE
Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode — MODERATE
moderate cvePyPI jinja22 in 1 version
2.10 — GHSA-cpwx-vrp4-4pq7, GHSA-g3rq-g295-4j3m
Jinja2 vulnerable to sandbox breakout through attr filter selecting format method — MODERATE
Regular Expression Denial of Service (ReDoS) in Jinja2 — MODERATE
advisory cvePyPI pyyaml@3.13PYSEC-2018-49
In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced fo — UNKNOWN
AI audit · anxolerd/dvpwa · 14 dimensions · usually within 15 minutes*
14 things unaudited
Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.
The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.
SecurityPriority: Core
Privacy & CompliancePriority: Core
Reliability & ResiliencePriority: Core
Code Quality & ArchitecturePriority: Important
AI / Vibe Coding RiskPriority: Important
Performance & ScalabilityPriority: Important
Infrastructure & DevOpsPriority: Important
Data LayerPriority: Important
Business & Product RiskPriority: Supporting
Developer ExperiencePriority: Supporting
Accessibility & UXPriority: Supporting
ObservabilityPriority: Supporting
Maintainability ForecastPriority: Specialized
IP & Novelty ExposurePriority: Specialized
Modules run (2)
Hardcoded Secret ScanDependency Vulnerability Scan
Scanned 33 of 58 files · anxolerd/dvpwa
Dependency manifests: 1 Python manifest read.
README badge
[](https://nittim.com/library/anxolerd/dvpwa)