Scan report

romankurnovskii / homebrew-awesome-brew

View on GitHub (opens in a new tab)
Ruby
115 stars
Scanned 24 Sep 2026, 10:25

Report Rescan

Vulnerability Low

Could an attacker exploit mistakes in this code?

17 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 0
Medium: 13
Low: 5

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

1 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 0
Medium: 0
Low: 3

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

21 total findings

Likely real: 7
Uncertain: 0
Likely noise: 14

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

7 findings likely need attention, 14 look like noise. Most notable: This Dependabot configuration does not set a cooldown period. Newly published packages ... in /.github/dependabot.yml (99% confidence).

Detections by engine

Bandit 12

Python security linter · Vulnerability
Semgrep 6

Pattern-based code analysis · Vulnerability
YARA 2

Malware signature rules · Malicious pattern
GuardDog 1

Supply-chain attack heuristics · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/dependabot.yml line 13

Likely real
Yes, 99% confidence

This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown
```
- package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/dependabot.yml line 8

Likely real
Yes, 99% confidence

This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown
```
- package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "weekly"
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/Formula/unrar.rb line 35

Likely real
Yes, 56% confidence

Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
```
assert_equal contentpath, `#{bin}/unrar lb #{rarpath}`.strip
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/Formula/openssl@1.0.rb line 61

Likely real
Yes, 56% confidence

Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.
```
certs_list = `security find-certificate -a -p #{keychains.join(" ")}`
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/update_casks.yml line 16

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/checkout@v7
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/.github/workflows/update_casks.yml line 19

Likely real
Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.
```
uses: actions/setup-python@v7
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /generate_casks.py line 122
Likely real: Probably noise, 22% confidence

Call to requests without timeout

121                             asset_url_intel = asset.browser_download_url
122                             response = requests.get(asset_url_intel)
123                             sha256_intel = hashlib.sha256(response.content).hexdigest()

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/generate_casks.py line 118

Likely real
Probably noise, 22% confidence

Call to requests without timeout
```
117                             asset_url_arm = asset.browser_download_url
118                             response = requests.get(asset_url_arm)
119                             sha256_arm = hashlib.sha256(response.content).hexdigest()
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/generate_formulas.py line 162

Likely real
Probably noise, 22% confidence

Call to requests without timeout
```
161                         try:
162                             response = requests.get(urls[arch])
163                             shas[arch] = hashlib.sha256(response.content).hexdigest()
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /generate_casks.py line 143
Likely real: Probably noise, 22% confidence

Call to requests without timeout

142                         asset_url_universal = asset.browser_download_url
143                         response = requests.get(asset_url_universal)
144                         sha256_universal = hashlib.sha256(response.content).hexdigest()

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/generate_casks.py line 137

Likely real
Probably noise, 22% confidence

Call to requests without timeout
```
136                     asset_url_intel = asset.browser_download_url
137                     response = requests.get(asset_url_intel)
138                     sha256_intel = hashlib.sha256(response.content).hexdigest()
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/generate_casks.py line 133

Likely real
Probably noise, 22% confidence

Call to requests without timeout
```
132                     asset_url_arm = asset.browser_download_url
133                     response = requests.get(asset_url_arm)
134                     sha256_arm = hashlib.sha256(response.content).hexdigest()
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /generate_casks.py line 126
Likely real: Probably noise, 22% confidence

Call to requests without timeout

125                             asset_url_universal = asset.browser_download_url
126                             response = requests.get(asset_url_universal)
127                             sha256_universal = hashlib.sha256(response.content).hexdigest()

Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/generate_casks.py line 76

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
def main():
    token = os.getenv("AC_TOKEN")
    if token:
        g = Github(auth=Auth.Token(token))
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/update_casks.py line 74

Likely real
Probably noise, 13% confidence

Starting a process with a partial executable path
```
73 
74         subprocess.run(["rm", "-rf", "./temp_repo"])
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/update_casks.py line 3

Likely real
Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.
```
2 import json
3 import subprocess
4 import shutil
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/update_casks.py line 72

Likely real
Probably noise, 12% confidence

Starting a process with a partial executable path
```
71 
72                     subprocess.run(["mv", os.path.join(root, file), dest_path])
73
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/update_casks.py line 74

Likely real
Probably noise, 4% confidence

subprocess call - check for execution of untrusted input.
```
73 
74         subprocess.run(["rm", "-rf", "./temp_repo"])
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/update_casks.py line 72

Likely real
Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.
```
71 
72                     subprocess.run(["mv", os.path.join(root, file), dest_path])
73
```