hongbo-miao / hongbomiao.com

Large result: showing the top 300 of 666 findings (up to 200 per engine, most severe and most likely real first). Totals above include everything.

1. high Semgrep The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. /autonomy/camera-radar-lidar-fusion/src/shared/lidar/services/load_lidar_data.rs:10 100%
2. high Semgrep The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. /autonomy/camera-radar-lidar-fusion/src/shared/map/services/load_ego_pose.rs:16 100%
3. high Semgrep The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. /autonomy/camera-radar-lidar-fusion/src/shared/radar/services/load_radar_data.rs:11 100%
4. high Semgrep The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. /data-processing/nats/audio-stream/audio-stream-sinker/src/shared/parquet/utils/write_transcription_batch_to_parquet.rs:76 100%
5. high Semgrep The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. /data-processing/pulsar/audio-stream/audio-stream-publisher/src/config.rs:14 100%
6. high Semgrep The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. /autonomy/camera-radar-lidar-fusion/src/main.rs:75 100%
7. high Semgrep Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'. /api/api-go/internal/graphql_server/utils/get_user.go:21 99%
8. high Semgrep Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'. /api/api-go/internal/graphql_server/utils/verify_password.go:20 99%
9. high Semgrep Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'. /api/api-go/internal/graphql_server/utils/get_user_by_email.go:21 99%
10. high Semgrep Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'. /api/api-go/internal/graphql_server/utils/get_prediction.go:44 99%
11. high Semgrep Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'. /api/api-go/internal/graphql_server/utils/get_me.go:29 99%
12. high Semgrep Found an insecure gRPC connection using 'insecure.NewCredentials()'. This creates a connection without encryption to a gRPC server. A malicious attacker could tamper with the gRPC message, which could compromise the machine. Instead, establish a secure connection with an SSL certificate using the 'grpc.WithTransportCredentials()' function. You can create a create credentials using a 'tls.Config{}' struct with 'credentials.NewTLS()'. The final fix looks like this: 'grpc.WithTransportCredentials(credentials.NewTLS(<config>))'. /api/api-go/internal/graphql_server/utils/get_greeting.go:28 99%
13. high Semgrep AWS Secret Access Key detected /kubernetes/argo-cd/projects/nebius/production-hm/spark-history-server/environments/production/kubernetes-manifests/hm-spark-history-server-secret.yaml:10 99%
14. high Semgrep AWS Secret Access Key detected /kubernetes/argo-cd/projects/nebius/production-hm/loki/environments/production/kubernetes-manifests/hm-loki-secret.yaml:10 99%
15. high Semgrep AWS Secret Access Key detected /kubernetes/argo-cd/projects/nebius/production-hm/mimir/environments/production/kubernetes-manifests/hm-mimir-secret.yaml:10 99%
16. high Semgrep AWS Secret Access Key detected /kubernetes/argo-cd/projects/nebius/production-hm/mlflow/environments/production/kubernetes-manifests/hm-mlflow-secret.yaml:10 99%
17. high Semgrep AWS Secret Access Key detected /kubernetes/argo-cd/projects/nebius/production-hm/nimtable/environments/production/kubernetes-manifests/hm-nimtable-secret.yaml:12 99%
18. high Semgrep AWS Secret Access Key detected /kubernetes/argo-cd/projects/nebius/production-hm/polaris/environments/production/kubernetes-manifests/hm-polaris-secret.yaml:10 99%
19. high Semgrep AWS Secret Access Key detected /kubernetes/argo-cd/projects/nebius/production-hm/pyroscope/environments/production/kubernetes-manifests/hm-pyroscope-secret.yaml:10 99%
20. high Semgrep AWS Secret Access Key detected /kubernetes/argo-cd/projects/nebius/production-hm/spark-connect-server-large/environments/production/kubernetes-manifests/hm-spark-connect-server-large-secret.yaml:10 99%
21. high Semgrep AWS Secret Access Key detected /kubernetes/argo-cd/projects/nebius/production-hm/spark-jobs/environments/production/kubernetes-manifests/object-storage-secret.yaml:10 99%
22. high Semgrep AWS Secret Access Key detected /kubernetes/argo-cd/projects/nebius/production-hm/tempo/environments/production/kubernetes-manifests/hm-tempo-secret.yaml:10 99%
23. high Semgrep AWS Secret Access Key detected /kubernetes/argo-cd/projects/nebius/production-hm/trino-rabbit/environments/production/kubernetes-manifests/hm-trino-secret.yaml:10 99%
24. high Semgrep AWS Secret Access Key detected /kubernetes/argo-cd/projects/nebius/production-hm/vllm/environments/production/kubernetes-manifests/hm-vllm-secret.yaml:10 99%
25. high Semgrep GitHub Token detected /kubernetes/argo-cd/projects/nebius/production-hm/atlantis/environments/production/secrets/hm-atlantis-secret.unsealed.yaml.example:13 99%
26. high Semgrep GitHub Token detected /kubernetes/argo-cd/projects/nebius/production-hm/gha-runner-scale-set-large/environments/production/secrets/hm-gha-runner-scale-set-large-secret.unsealed.yaml.example:11 99%
27. high Semgrep GitHub Token detected /kubernetes/argo-cd/projects/nebius/production-hm/gha-runner-scale-set-medium/environments/production/secrets/hm-gha-runner-scale-set-medium-secret.unsealed.yaml.example:11 99%
28. high Semgrep The last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'. /data-visualization/grafana/hm-panel-plugin/.config/Dockerfile:26 99%
29. high GuardDog Detects steganography decode followed by code execution [threat-runtime-obfuscation-steganography] /computer-vision/anyup/src/main.py:51 91%
30. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1688 87%
31. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1418 87%
32. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1675 87%
33. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1658 87%
34. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1647 87%
35. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1631 87%
36. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1615 87%
37. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1506 87%
38. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1488 87%
39. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1459 87%
40. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1156 87%
41. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1439 87%
42. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1394 87%
43. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1383 87%
44. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1332 87%
45. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1315 87%
46. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1295 87%
47. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1282 87%
48. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1269 87%
49. high Semgrep This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`. /.github/workflows/test.yml:1229 87%
50. high Semgrep sqlalchemy.text passes the constructed SQL statement to the database mostly unchanged. This means that the usual SQL injection protections are not applied and this function is vulnerable to SQL injection if user input can reach here. Use normal SQLAlchemy operators (such as `or_()`, `and_()`, etc.) to construct SQL. /data-storage/delta-lake/read-delta-lake-by-trino/src/main.py:20 55%
51. high Semgrep Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option. /data-storage/hm-duckdb/query-amazon-s3/src/main.py:29 53%
52. high Semgrep Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option. /data-storage/hm-duckdb/query-amazon-s3/src/main.py:41 53%
53. high Semgrep Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option. /data-storage/hm-duckdb/query-amazon-s3/src/main.py:52 53%
54. high Semgrep Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option. /data-storage/hm-duckdb/query-parquet/src/main.py:15 53%
55. high Semgrep Generic API Key detected /kubernetes/argo-cd/projects/aws/production-hm/litellm/environments/production/kubernetes-manifests/hm-litellm-secret.yaml:9 52%
56. high Semgrep Functions reliant on pickle can result in arbitrary code execution. Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX /graph-neural-network/src/main.py:215 51%
57. high Semgrep Generic Secret detected /api/api-go/config/graphql_server/.env.production:6 51%
58. high Semgrep Generic Secret detected /api/api-go/config/graphql_server/.env.development:6 51%
59. high Semgrep Generic Secret detected /api/api-node/.env.development.local.example:1 51%
60. high Semgrep Generic Secret detected /api/api-node/.env.development.local.example.docker:1 51%
61. high Semgrep Generic Secret detected /api/api-node/.env.production.local.example:3 51%
62. high Semgrep Generic Secret detected /api/api-node/.env.test:3 51%
63. high Semgrep Generic Secret detected /kubernetes/argo-cd/projects/nebius/production-hm/mlflow/environments/production/kubernetes-manifests/hm-mlflow-secret.yaml:14 51%
64. high Semgrep Generic Secret detected /kubernetes/argo-cd/projects/nebius/production-hm/nimtable/environments/production/kubernetes-manifests/hm-nimtable-secret.yaml:13 51%
65. high Semgrep Generic Secret detected /kubernetes/argo-cd/projects/nebius/production-hm/trino-gateway/environments/production/kubernetes-manifests/hm-trino-gateway-secret.yaml:9 51%
66. high Semgrep Generic Secret detected /kubernetes/argo-cd/projects/nebius/production-hm/trino-rabbit/environments/production/kubernetes-manifests/hm-trino-secret.yaml:12 51%
67. high Semgrep Generic Secret detected /security/ory-hydra/justfile:1 51%
68. high Semgrep Functions reliant on pickle can result in arbitrary code execution. Consider loading from `state_dict`, using fickling, or switching to a safer serialization method like ONNX /large-language-model-pre-training/training-optimization/automatic-mixed-precision/src/main.py:167 51%
69. high Semgrep Generic Secret detected /kubernetes/manifests/west/graphql-server-configmap.yaml:28 50%
70. high Semgrep Generic Secret detected /kubernetes/manifests/akhq/helm/my-values.yaml:14 50%
71. high Semgrep Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. /data-processing/pulsar/audio-stream/audio-stream-transcriber/.env.development:6 50%
72. high Semgrep Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. /data-processing/pulsar/audio-stream/audio-stream-transcriber/.env.production:6 50%
73. high Semgrep Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. /data-processing/pulsar/audio-stream/pulsar-livekit-bridge/.env.development:3 50%
74. high Semgrep Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. /data-processing/pulsar/audio-stream/pulsar-livekit-bridge/.env.production:3 50%
75. high Semgrep Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. /video/media-streaming-server/livekit/multimedia-publisher/.env.development:6 50%
76. high Semgrep Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. /video/media-streaming-server/livekit/multimedia-publisher/.env.production:6 50%
77. high Semgrep Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. /video/media-streaming-server/livekit/multimedia-publisher/src/shared/egress/services/start_track_composite_hls_egress.rs:26 50%
78. high Semgrep Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. /video/media-streaming-server/livekit/multimedia-publisher/src/shared/egress/services/stop_hls_egress.rs:10 50%
79. high Semgrep JWT token detected /security/defguard/docker-compose.development.yaml:34 50%
80. high Semgrep Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. /data-processing/pulsar/audio-stream/pulsar-livekit-bridge/src/main.rs:51 50%
81. high Semgrep Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. /video/media-streaming-server/livekit/kubernetes/livekit-egress/livekit-egress-config.yaml:11 50%
82. high Semgrep Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. /video/media-streaming-server/livekit/multimedia-publisher/src/main.rs:62 50%
83. high Semgrep bcrypt hash detected /kubernetes/argo-cd/justfile:7 49%
84. high Semgrep bcrypt hash detected /kubernetes/argo-cd/justfile:4 49%
85. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /data-visualization/hm-dash/parquet-visualizer/Dockerfile:15 24%
86. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /api/real-time-ai-agent/sensor-stream-publisher/Dockerfile:25 23%
87. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /data-processing/nats/sticky-telemetry-stream/sticky-telemetry-stream-subscriber/Dockerfile:16 22%
88. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /web/Dockerfile:15 22%
89. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /data-processing/pulsar/audio-stream/audio-stream-publisher/Dockerfile:21 22%
90. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /data-processing/pulsar/audio-stream/audio-stream-transcriber/Dockerfile:18 22%
91. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /data-processing/pulsar/audio-stream/grpc-server/Dockerfile:24 22%
92. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /data-processing/pulsar/audio-stream/pulsar-livekit-bridge/Dockerfile:26 22%
93. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /data-processing/pulsar/sticky-telemetry-stream/sticky-telemetry-stream-flink-compute/Dockerfile:28 22%
94. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /data-processing/pulsar/sticky-telemetry-stream/sticky-telemetry-stream-mqtt-publisher/Dockerfile:12 22%
95. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /data-processing/pulsar/sticky-telemetry-stream/sticky-telemetry-stream-pulsar-publisher/Dockerfile:15 22%
96. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /data-processing/pulsar/sticky-telemetry-stream/sticky-telemetry-stream-subscriber/Dockerfile:15 22%
97. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /data-processing/pulsar/sticky-telemetry-stream/sticky-telemetry-stream-validate-function/Dockerfile:18 22%
98. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /data-storage/doris/storage-compute-decoupled/arrow-flight-sql-client/Dockerfile:8 22%
99. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /video/media-streaming-server/livekit/multimedia-publisher/Dockerfile:23 22%
100. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /data-processing/kafka/kafka-client/sticky-telemetry-stream/sticky-telemetry-stream-subscriber/Dockerfile:16 22%
101. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /api/api-go/deployment/config_loader/Dockerfile:18 22%
102. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /api/api-go/deployment/decision_logger/Dockerfile:18 22%
103. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /api/api-go/deployment/graphql_server/Dockerfile:18 22%
104. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /api/api-go/deployment/grpc_server/Dockerfile:18 22%
105. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /api/api-python/Dockerfile:68 22%
106. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /api/api-rust/Dockerfile:14 22%
107. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /api/real-time-ai-agent/agent/Dockerfile:26 22%
108. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /cloud-platform/cilium/multi-cloud-data-pipeline/sensor-gateway/Dockerfile:14 22%
109. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /data-orchestration/temporal/api-server/Dockerfile:25 22%
110. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /data-orchestration/temporal/worker/Dockerfile:26 22%
111. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /data-processing/kafka/kafka-client/sticky-telemetry-stream/sticky-telemetry-stream-publisher/Dockerfile:16 22%
112. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /data-processing/nats/sticky-telemetry-stream/sticky-telemetry-stream-publisher/Dockerfile:16 22%
113. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /kubernetes/scripts/utils/install_linkerd_buoyant.sh 1%
114. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /machine-learning/hm-mlflow/experiments/classify-mnist/skypilot.yaml 1%
115. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /embedded-system/mender/streamer-builder/Dockerfile 1%
116. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /embedded-system/freertos/justfile 1%
117. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /operating-system/ubuntu/justfile 0%
118. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /robotics/robot-operating-system/scripts/set_up.sh 0%
119. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /operating-system/windows/scripts/enable_ssh.ps1 0%
120. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/pulsar/sticky-telemetry-stream/sticky-telemetry-stream-pulsar-publisher/pyproject.toml:18 99%
121. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-storage/hm-duckdb/query-lance/pyproject.toml:18 99%
122. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-storage/hm-duckdb/query-duckdb/pyproject.toml:17 99%
123. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-storage/hm-duckdb/query-amazon-s3/pyproject.toml:19 99%
124. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-storage/delta-lake/write-to-delta-lake/pyproject.toml:18 99%
125. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-storage/delta-lake/read-delta-lake-by-trino/pyproject.toml:18 99%
126. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-storage/delta-lake/read-delta-lake-by-amazon-athena/pyproject.toml:16 99%
127. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/pulsar/sticky-telemetry-stream/sticky-telemetry-stream-validate-function/pyproject.toml:19 99%
128. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/pulsar/sticky-telemetry-stream/sticky-telemetry-stream-subscriber/pyproject.toml:18 99%
129. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/pulsar/sticky-telemetry-stream/sticky-telemetry-stream-schema/pyproject.toml:16 99%
130. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-storage/hm-duckdb/query-protobuf/pyproject.toml:18 99%
131. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/pulsar/sticky-telemetry-stream/sticky-telemetry-stream-integration-test/pyproject.toml:19 99%
132. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/pulsar/sticky-telemetry-stream/sticky-telemetry-stream-flink-compute/pyproject.toml:18 99%
133. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/pulsar/audio-stream/audio-stream-flink-compute/pyproject.toml:19 99%
134. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/nats/telemetry-stream/telemetry-stream-subscriber/pyproject.toml:18 99%
135. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/nats/telemetry-stream/telemetry-stream-publisher/pyproject.toml:18 99%
136. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/nats/sticky-telemetry-stream/sticky-telemetry-stream-subscriber/pyproject.toml:18 99%
137. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/nats/sticky-telemetry-stream/sticky-telemetry-stream-publisher/pyproject.toml:18 99%
138. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/kafka/kafka-client/sticky-telemetry-stream/sticky-telemetry-stream-subscriber/pyproject.toml:18 99%
139. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/kafka/kafka-client/sticky-telemetry-stream/sticky-telemetry-stream-publisher/pyproject.toml:18 99%
140. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/ingest-flac-to-parquet/pyproject.toml:18 99%
141. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/hm-spark/applications/spark-connect/pyproject.toml:16 99%
142. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /audio/automatic-speech-recognition-evaluation/hm-jiwer/pyproject.toml:16 99%
143. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /audio/voice-activity-detection/rnnoise-vad/pyproject.toml:17 99%
144. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /audio/voice-activity-detection/hm-silero-vad/pyproject.toml:18 99%
145. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /audio/speech-quality-assessment/torchaudio-squim/pyproject.toml:20 99%
146. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /audio/speaker-diarization/streaming-sortformer-diarizer/pyproject.toml:16 99%
147. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /audio/speaker-diarization/hm-diart/pyproject.toml:17 99%
148. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /audio/automatic-speech-recognition-inference/qwen3-asr/pyproject.toml:16 99%
149. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /audio/automatic-speech-recognition-inference/nvidia-nemo/pyproject.toml:16 99%
150. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /audio/automatic-speech-recognition-inference/hm-whisperx/pyproject.toml:20 99%
151. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /audio/automatic-speech-recognition-inference/hm-speaches/pyproject.toml:16 99%
152. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /audio/automatic-speech-recognition-inference/hm-faster-whisper/pyproject.toml:16 99%
153. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-storage/hm-duckdb/query-parquet/pyproject.toml:17 99%
154. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /audio/audio-signal-analysis/hm-librosa/pyproject.toml:18 99%
155. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /api/api-rust/scripts/pyproject.toml:17 99%
156. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /api/api-python/pyproject.toml:27 99%
157. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /aerospace/x-plane/udp/pyproject.toml:13 99%
158. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /aerospace/x-plane/rest-api/pyproject.toml:16 99%
159. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /aerospace/hm-openaerostruct/pyproject.toml:18 99%
160. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /aerospace/hm-aerosandbox/pyproject.toml:18 99%
161. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /aerospace/flightradar24/pyproject.toml:17 99%
162. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /aerospace/bluesky/pyproject.toml:16 99%
163. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/hm-spark/applications/recommend-movies/pyproject.toml:17 99%
164. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /computer-vision/export-yolo-to-onnx/pyproject.toml:16 99%
165. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /audio/voice-activity-detection/webrtc-vad/pyproject.toml:17 99%
166. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-analytics/hm-marimo/pyproject.toml:16 99%
167. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-analytics/hm-geopandas/pyproject.toml:20 99%
168. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-analytics/hm-daft/analyze-transactions/pyproject.toml:17 99%
169. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-analytics/hm-cupy/pyproject.toml:16 99%
170. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-analytics/hm-cudf/analyze-transactions/pyproject.toml:17 99%
171. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /convolutional-neural-network/pyproject.toml:22 99%
172. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /computer-vision/vision-transformer/dinov3/pyproject.toml:21 99%
173. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /computer-vision/hm-supervision/detect-objects/pyproject.toml:18 99%
174. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /computer-vision/hm-pyvista/mount-saint-helens/pyproject.toml:16 99%
175. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /computer-vision/hm-open3d/pyproject.toml:21 99%
176. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-analytics/hm-narwhals/pyproject.toml:16 99%
177. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /computer-vision/anyup/pyproject.toml:18 99%
178. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /cloud-platform/cilium/multi-cloud-data-pipeline/sensor-gateway/pyproject.toml:15 99%
179. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /cloud-platform/aws/aws-parallelcluster/pcluster/pyproject.toml:14 99%
180. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /cloud-platform/aws/amazon-sagemaker/pytorch-mnist/pyproject.toml:18 99%
181. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /cloud-computing/hm-skypilot/pyproject.toml:16 99%
182. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /cloud-computing/hm-ray/hm-ray/pyproject.toml:16 99%
183. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /cloud-computing/hm-ray/applications/process-flight-data/pyproject.toml:19 99%
184. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /cloud-computing/hm-ray/applications/daft-analysis/pyproject.toml:18 99%
185. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /cloud-computing/hm-ray/applications/calculate/pyproject.toml:16 99%
186. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /autonomy/camera-radar-fusion/pyproject.toml:21 99%
187. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-orchestration/hm-dbos/pyproject.toml:17 99%
188. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/hm-spark/applications/find-taxi-top-routes/pyproject.toml:16 99%
189. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/hm-spark/applications/find-taxi-top-routes-sql/pyproject.toml:16 99%
190. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/hm-spark/applications/find-retired-people-python/pyproject.toml:16 99%
191. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/hm-spark/applications/analyze-coffee-customers/pyproject.toml:18 99%
192. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/hm-pathway/pipelines/aggregate-hourly-events/pyproject.toml:16 99%
193. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-processing/hm-cocoindex/flows/embed-markdown-to-postgres/pyproject.toml:18 99%
194. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-orchestration/hm-prefect/workflows/ingest-parquet-to-iceberg/pyproject.toml:18 99%
195. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-orchestration/hm-prefect/workflows/greet/pyproject.toml:18 99%
196. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-orchestration/hm-prefect/workflows/calculate/pyproject.toml:18 99%
197. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-orchestration/hm-prefect/pyproject.toml:13 99%
198. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-analytics/hm-networkx/pyproject.toml:17 99%
199. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-orchestration/hm-airflow/pyproject.toml:16 99%
200. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-extraction/hm-olmocr/pyproject.toml:16 99%
201. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-extraction/hm-mineru/pyproject.toml:16 99%
202. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-extraction/hm-docling/pyproject.toml:16 99%
203. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-crawling/hm-firecrawl/pyproject.toml:17 99%
204. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-crawling/hm-crawl4ai/pyproject.toml:17 99%
205. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-analytics/hm-polars/analyze-transactions-gpu/pyproject.toml:17 99%
206. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-analytics/hm-polars/analyze-transactions-cpu/pyproject.toml:17 99%
207. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-analytics/hm-pandas/analyze-transactions/pyproject.toml:17 99%
208. medium Semgrep This pyproject.toml configures uv but does not set a dependency cooldown. Newly published packages can be malicious or unstable. Add `exclude-newer = "7 days"` under `[tool.uv]` to wait 7 days before resolving newly published package versions. Added in: 0.9.17 Reference: https://docs.astral.sh/uv/concepts/resolution/#dependency-cooldowns /data-analytics/hm-numba/pyproject.toml:16 99%
209. medium GuardDog Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] /aerospace/flightradar24/src/config.py:12 96%
210. medium Bandit Use of unsafe PyTorch load /multimodal-model/vision-language-action-model/vision-language-action/infer/src/shared/agent/utils/create_vla_agent.py:91 49%
211. medium Bandit Use of unsafe PyTorch load /multimodal-model/vision-language-action-model/vision-language-action/infer/src/shared/agent/utils/create_vla_agent.py:67 49%
212. medium Bandit Use of unsafe PyTorch load /multimodal-model/vision-language-action-model/vision-language-action/train/src/scripts/validate_action_predictions.py:55 49%
213. medium Bandit Use of unsafe PyTorch load /multimodal-model/vision-language-action-model/vision-language-action/train/src/scripts/validate_action_predictions.py:68 49%
214. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /machine-learning/nvidia-dali/src/main.py:31 49%
215. medium Bandit Possible SQL injection vector through string-based query construction. /cloud-computing/hm-ray/applications/daft-analysis/src/main.py:10 46%
216. medium Bandit Possible SQL injection vector through string-based query construction. /data-storage/hm-duckdb/query-amazon-s3/src/main.py:41 46%
217. medium Bandit Possible SQL injection vector through string-based query construction. /data-storage/hm-duckdb/query-amazon-s3/src/main.py:47 46%
218. medium Bandit Possible SQL injection vector through string-based query construction. /data-storage/hm-duckdb/query-parquet/src/main.py:11 46%
219. medium Bandit Possible SQL injection vector through string-based query construction. /data-visualization/hm-dash/parquet-visualizer/src/main.py:60 46%
220. medium Bandit Possible SQL injection vector through string-based query construction. /data-visualization/iads/iads-data-manager/iads-data-reader/src/utils/iads_util.py:45 46%
221. medium Bandit Possible SQL injection vector through string-based query construction. /data-storage/delta-lake/read-delta-lake-by-trino/src/main.py:21 46%
222. medium Bandit Possible binding to all interfaces. /cloud-platform/cilium/multi-cloud-data-pipeline/sensor-gateway/src/main.py:24 37%
223. medium Bandit Probable insecure usage of temp file/directory. /data-orchestration/hm-airflow/dags/s3_download.py:31 25%
224. medium Bandit Unsafe Hugging Face Hub download without revision pinning in load_dataset() /large-language-model-post-training/fine-tuning/direct-preference-optimization/low-rank-adaptation/src/main.py:35 19%
225. medium Bandit Unsafe Hugging Face Hub download without revision pinning in load_dataset() /large-language-model-post-training/fine-tuning/supervised-fine-tuning/quantized-low-rank-adaptation/src/main.py:59 19%
226. medium Bandit Unsafe Hugging Face Hub download without revision pinning in load_dataset() /large-language-model-post-training/fine-tuning/supervised-fine-tuning/low-rank-adaptation/src/main.py:29 19%
227. medium Bandit Unsafe Hugging Face Hub download without revision pinning in load_dataset() /large-language-model-post-training/fine-tuning/proximal-policy-optimization/low-rank-adaptation/src/main.py:182 19%
228. medium Bandit Unsafe Hugging Face Hub download without revision pinning in load_dataset() /large-language-model-post-training/fine-tuning/hm-unsloth/src/main.py:64 19%
229. medium Bandit Unsafe Hugging Face Hub download without revision pinning in load_dataset() /large-language-model-post-training/fine-tuning/hm-unsloth/src/main.py:63 19%
230. medium Bandit Unsafe Hugging Face Hub download without revision pinning in load_dataset() /large-language-model-post-training/fine-tuning/group-relative-policy-optimization/low-rank-adaptation/src/main.py:107 19%
231. medium Bandit Unsafe Hugging Face Hub download without revision pinning in load_dataset() /large-language-model-post-training/fine-tuning/fine-tune-whisper/src/main.py:82 19%
232. medium Bandit Unsafe Hugging Face Hub download without revision pinning in load_dataset() /large-language-model-post-training/fine-tuning/fine-tune-whisper/src/main.py:76 19%
233. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-post-training/fine-tuning/proximal-policy-optimization/low-rank-adaptation/src/main.py:60 17%
234. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /vision-language-model/qwen-vl/src/main.py:26 17%
235. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-post-training/fine-tuning/proximal-policy-optimization/low-rank-adaptation/src/main.py:49 17%
236. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-post-training/fine-tuning/proximal-policy-optimization/low-rank-adaptation/src/main.py:39 17%
237. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-post-training/fine-tuning/proximal-policy-optimization/low-rank-adaptation/src/main.py:32 17%
238. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-post-training/fine-tuning/hm-tinker/src/qwen3_renderer.py:19 17%
239. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-post-training/fine-tuning/group-relative-policy-optimization/low-rank-adaptation/src/main.py:98 17%
240. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-post-training/fine-tuning/group-relative-policy-optimization/low-rank-adaptation/src/main.py:93 17%
241. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-post-training/fine-tuning/fine-tune-whisper/src/main.py:187 17%
242. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-post-training/fine-tuning/fine-tune-whisper/src/main.py:182 17%
243. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-post-training/fine-tuning/direct-preference-optimization/low-rank-adaptation/src/main.py:24 17%
244. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-post-training/fine-tuning/direct-preference-optimization/low-rank-adaptation/src/main.py:19 17%
245. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-inference/speculative-decoding/src/main.py:29 17%
246. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-inference/speculative-decoding/src/main.py:26 17%
247. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-inference/speculative-decoding/src/main.py:25 17%
248. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /computer-vision/vision-transformer/dinov3/src/shared/model/utils/get_model.py:31 17%
249. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-post-training/fine-tuning/supervised-fine-tuning/low-rank-adaptation/src/main.py:19 17%
250. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /vision-language-model/qwen-vl/src/main.py:14 17%
251. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /tokenization/byte-pair-encoding/src/main.py:105 17%
252. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /small-language-model/gemma/src/main.py:26 17%
253. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /small-language-model/gemma/src/main.py:23 17%
254. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /named-entity-recognition/bert/src/main.py:12 17%
255. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /named-entity-recognition/bert/src/main.py:11 17%
256. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /multimodal-model/vision-language-action-model/vision-language-action/lib/src/vision_language_action_lib/vision/utils/load_vision_model.py:25 17%
257. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /multimodal-model/vision-language-action-model/vision-language-action/lib/src/vision_language_action_lib/language/utils/load_language_model.py:30 17%
258. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /multimodal-model/vision-language-action-model/vision-language-action/lib/src/vision_language_action_lib/language/utils/load_language_model.py:29 17%
259. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /multimodal-model/vision-language-action-model/openvla/src/main.py:37 17%
260. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /multimodal-model/vision-language-action-model/openvla/src/main.py:36 17%
261. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-pre-training/training-paradigm/masked-language-model/neo-bert/src/main.py:17 17%
262. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-pre-training/training-paradigm/masked-language-model/neo-bert/src/main.py:13 17%
263. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-pre-training/training-paradigm/masked-language-model/modern-bert/src/main.py:14 17%
264. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-pre-training/training-paradigm/masked-language-model/modern-bert/src/main.py:13 17%
265. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-pre-training/training-paradigm/masked-language-model/convert-modern-bert-to-core-ml/src/main.py:37 17%
266. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-pre-training/training-paradigm/masked-language-model/convert-modern-bert-to-core-ml/src/main.py:36 17%
267. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-pre-training/training-paradigm/causal-language-model/qwen3/src/main.py:14 17%
268. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-pre-training/training-paradigm/causal-language-model/qwen3/src/main.py:13 17%
269. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-post-training/fine-tuning/supervised-fine-tuning/quantized-low-rank-adaptation/src/main.py:54 17%
270. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-post-training/fine-tuning/supervised-fine-tuning/quantized-low-rank-adaptation/src/main.py:47 17%
271. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-post-training/fine-tuning/supervised-fine-tuning/low-rank-adaptation/src/main.py:24 17%
272. medium Bandit Unsafe Hugging Face Hub download without revision pinning in from_pretrained() /large-language-model-post-training/fine-tuning/proximal-policy-optimization/low-rank-adaptation/src/main.py:70 17%
273. low GuardDog Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read] /api/api-go/internal/config_loader/utils/get_config.go:51 93%
274. low GuardDog Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read] /api/api-go/internal/config_loader/utils/get_config.go:46 93%
275. low GuardDog Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read] /api/api-go/internal/config_loader/utils/get_config.go:43 93%
276. low Bandit Possible hardcoded password: '' /autonomy/camera-radar-fusion/src/shared/fusion/services/visualize_camera_radar_fusion.py:50 45%
277. low Bandit Possible hardcoded password: '' /load-testing/hm-locust/src/main.py:11 44%
278. low Bandit Consider possible security implications associated with the subprocess module. /data-visualization/iads/iads-data-manager/iads-data-reader/src/utils/iads_util.py:4 12%
279. low Bandit subprocess call - check for execution of untrusted input. /data-visualization/iads/iads-data-manager/iads-data-reader/src/utils/iads_util.py:129 3%
280. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /data-storage/hm-pgbackrest/Dockerfile 0%
281. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /data-storage/timescaledb/dummy_iot/scripts/ubuntu/install_timescaledb.sh 0%
282. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /.github/workflows/.lint.yml 0%
283. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /.github/workflows/.test-data-processing.yml 0%
284. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /.github/workflows/.test-api.yml 0%
285. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /embedded-system/yocto-project/scripts/build.sh 0%
286. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /data-processing/kafka/kafka-connect-cluster/opa-kafka-connect/Dockerfile 0%
287. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /data-processing/kafka/kafka-connect-cluster/iot-kafka-connect/Dockerfile 0%
288. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /data-processing/kafka/kafka-connect-cluster/logging-kafka-connect/Dockerfile 0%
289. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /large-language-model-post-training/post-training-quantization/justfile 0%
290. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /machine-learning/nvidia/justfile 0%
291. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /machine-learning/nvidia-dali/src/main.py 0%
292. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /api/api-python/Dockerfile 0%
293. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /kubernetes/argo-cd/projects/nebius/production-hm/mlflow/environments/production/kubernetes-manifests/hm-mlflow-oidc-group-detection-config-map.yaml 0%
294. low Bandit Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. /state-space-model/mamba2/src/models/simple_mamba2.py:35 0%
295. low Bandit Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. /large-language-model-post-training/fine-tuning/hm-tinker/src/qwen3_renderer.py:130 0%
296. low Bandit Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. /large-language-model-architecture/dense-transformer/src/main.py:129 0%
297. low Bandit Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. /large-language-model-architecture/dense-transformer/src/main.py:128 0%
298. low Bandit Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. /large-language-model-architecture/dense-transformer/src/main.py:104 0%
299. low Bandit Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. /computer-vision/anyup/src/main.py:70 0%
300. low Bandit Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. /aerospace/x-plane/udp/src/main.py:19 0%