Scan report

psf / requests

View on GitHub (opens in a new tab)
Python
54597 stars
Scanned 29 Oct 2026, 09:27

Report Rescan

Vulnerability Low

Could an attacker exploit mistakes in this code?

5 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 0
Medium: 3
Low: 16

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Safe

Does this code look like it is trying to cause harm?

0 risk score

No issues of this kind were found.

High: 0
Medium: 0
Low: 10

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

29 total findings

Likely real: 2
Uncertain: 1
Likely noise: 26

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

2 findings likely need attention, 26 look like noise. Most notable: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resist... in /src/requests/auth.py (52% confidence).

Detections by engine

Bandit 16

Python security linter · Vulnerability
Dependency checker 6

CVEs, typosquats and risky installs · Supply chain
YARA 4

Malware signature rules · Malicious pattern
Semgrep 3

Pattern-based code analysis · Vulnerability

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/requests/auth.py line 237

Likely real
Yes, 52% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
```
cnonce = hashlib.sha1(s, usedforsecurity=False).hexdigest()[:16]
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/requests/auth.py line 187

Likely real
Yes, 52% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
```
return hashlib.sha1(x, usedforsecurity=False).hexdigest()
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/src/requests/compat.py line 42

Likely real
Uncertain, 49% confidence

Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.
```
chardet = importlib.import_module(lib)
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'chardet>=3.0.2,<8' — attacker could push malicious update
```
chardet>=3.0.2,<8
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'PySocks>=1.5.6, !=1.5.7' — attacker could push malicious update
```
PySocks>=1.5.6, !=1.5.7
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'certifi>=2023.5.7' — attacker could push malicious update
```
certifi>=2023.5.7
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'urllib3>=1.26,<3' — attacker could push malicious update
```
urllib3>=1.26,<3
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'idna>=2.5,<4' — attacker could push malicious update
```
idna>=2.5,<4
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'charset_normalizer>=2,<4' — attacker could push malicious update
```
charset_normalizer>=2,<4
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/requests/sessions.py line 637

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
636 
637         assert _is_prepared(prep)
638
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/requests/sessions.py line 770

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
769 
770         assert _is_prepared(request)
771
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/requests/__init__.py line 66

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
65     urllib3_version_list = urllib3_version.split(".")[:3]
66     assert urllib3_version_list != ["dev"]  # Verify urllib3 isn't installed from git.
67
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/requests/sessions.py line 350

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
349         """
350         assert _is_prepared(prepared_request)
351         headers = prepared_request.headers
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/requests/sessions.py line 318

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
317         assert _is_prepared(original_request)
318         assert _is_prepared(prepared_request)
319
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/requests/sessions.py line 317

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
316         original_request = response.request
317         assert _is_prepared(original_request)
318         assert _is_prepared(prepared_request)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/requests/cookies.py line 46

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
45     def __init__(self, request: PreparedRequest) -> None:
46         assert _is_prepared(request)
47         self._r = request
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/requests/adapters.py line 659

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
658 
659         assert _is_prepared(request)
660
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/requests/adapters.py line 581

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
580         """
581         assert _is_prepared(request)
582
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/requests/adapters.py line 481

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
480         """
481         assert _is_prepared(request)
482
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/requests/adapters.py line 375

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
374         """
375         assert _is_prepared(req)
376         response = Response()
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/requests/_internal_utils.py line 46

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
45     """
46     assert isinstance(u_string, str)
47     try:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/requests/__init__.py line 90

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
89         # charset_normalizer >= 2.0.0 < 4.0.0
90         assert (2, 0, 0) <= (major, minor, patch) < (4, 0, 0)
91     else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/requests/__init__.py line 85

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
84         # chardet_version >= 3.0.2, < 8.0.0
85         assert (3, 0, 2) <= (major, minor, patch) < (8, 0, 0)
86     elif charset_normalizer_version:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/requests/__init__.py line 78

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
77     if major == 1:
78         assert minor >= 21
79
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/src/requests/__init__.py line 76

Likely real
Probably noise, 0% confidence

Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
```
75     # urllib3 >= 1.21.1
76     assert major >= 1
77     if major == 1:
```