<< Back to security report
Repositorypeterhajas/dotfiles →
Commit183b7e8 →
VerdictFAIL
Score60
DateMay 29, 2026
| Severity | Rule | Message | File:Line |
|---|---|---|---|
| MEDIUM | python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1 | Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. | peterhajas/dotfiles/tw-ff6419cf/tiddlywiki/bin/tiddlywiki_diff_tiddlers:52 → |
| HIGH | python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. | peterhajas/dotfiles/tw-ff6419cf/utils/bin/scad2usdz:500 → |
| HIGH | python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args | Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. | peterhajas/dotfiles/tw-ff6419cf/utils/bin/scad2usdz:519 → |
| MEDIUM | python.lang.security.audit.exec-detected.exec-detected | Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. | peterhajas/dotfiles/tw-ff6419cf/yabai/bin/test_yabai_update_tiling.py:36 → |