[Security] HIGH: 176 issue(s) found in osint-hub #57
Labels
No labels
agentic-osint
audit
blocked:commit-ready-failed
blocked:gate-fetch
blocked:gate-fetch
blocked:gate-lint
blocked:gate-plan
blocked:gate-research
blocked:needs-decision
blocked:needs-human
blocked:no-changes
blocked:preflight
blocked:verify-failed
bug
chore
deferred
enhancement
feature-request
in-progress
lint-baseline
lint-cleanup
needs-decompose
needs-triage
performance
quickfix
security/medium
triage-approved
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
Mark/osint-hub#57
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Security Scan Results for
osint-hubSeverity: HIGH
Findings: 176
1. secret_in_diff
e29bb357e29bb357AWS Secret Key2. secret_in_diff
9a0811609a081160AWS Secret Key3. secret_in_diff
63047ba463047ba4AWS Secret Key4. secret_in_diff
a615b5cea615b5ceAWS Secret Key5. secret_in_diff
4e96d28c4e96d28cAWS Secret Key6. secret_in_diff
c9637891c9637891AWS Secret Key7. secret_in_diff
ecac16abecac16abAWS Secret Key8. secret_in_diff
f96ed766AWS Secret Key9. secret_in_diff
75986d97AWS Secret Key10. secret_in_diff
93f326c993f326c9Password in URL11. secret_in_diff
dda91cc5dda91cc5AWS Secret Key12. secret_in_diff
2865d1c92865d1c9AWS Secret Key13. secret_in_diff
aadb7f84aadb7f84AWS Secret Key14. secret_in_diff
a00152e4a00152e4AWS Secret Key15. secret_in_diff
57d9495357d94953AWS Secret Key16. secret_in_diff
ecfce79decfce79dPassword in URL17. secret_in_diff
2f0f0d2d2f0f0d2dAWS Secret Key18. secret_in_diff
d88891bdd88891bdPassword in URL19. secret_in_diff
a9a3bd39a9a3bd39AWS Secret Key20. secret_in_diff
327f39d9327f39d9AWS Secret Key21. secret_in_diff
54dac6ec54dac6ecAWS Secret Key22. secret_in_diff
b652b46bb652b46bAWS Secret Key23. secret_in_diff
00040f8c00040f8cAWS Secret Key24. secret_in_diff
c8dcbed8c8dcbed8AWS Secret Key25. secret_in_diff
5a8b36555a8b3655Password in URL26. secret_in_diff
ca918477ca918477Password in URL27. secret_in_diff
9948d8cf9948d8cfAWS Secret Key28. secret_in_diff
9e680c0d9e680c0dAWS Secret Key29. secret_in_diff
17a33df617a33df6AWS Secret Key30. secret_in_diff
034598a3034598a3AWS Secret Key31. secret_in_diff
4671811f4671811fAWS Secret Key32. secret_in_diff
02ed9f4602ed9f46AWS Secret Key33. secret_in_diff
d6c910fbd6c910fbAWS Secret Key34. secret_in_diff
0a4339fb0a4339fbAWS Secret Key35. secret_in_diff
8c8c02168c8c0216AWS Secret Key36. secret_in_diff
43fd4d0e43fd4d0eAWS Secret Key37. secret_in_diff
ca35a9d5ca35a9d5AWS Secret Key38. secret_in_diff
b72faca4b72faca4AWS Secret Key39. secret_in_diff
d0773b61d0773b61AWS Secret Key40. secret_in_diff
e1c96af7e1c96af7AWS Secret Key41. secret_in_diff
c42a3078c42a3078AWS Secret Key42. secret_in_diff
b724f82bb724f82bAWS Secret Key43. secret_in_diff
965b7a58965b7a58AWS Secret Key44. secret_in_diff
b70adfd0b70adfd0Password in URL45. secret_in_diff
64f3d49a64f3d49aAWS Secret Key46. secret_in_diff
0ed5b4340ed5b434AWS Secret Key47. secret_in_diff
0b9847790b984779AWS Secret Key48. secret_in_diff
abadcb96abadcb96Password in URL49. secret_in_diff
021ec76d021ec76dAWS Secret Key50. secret_in_diff
e98c22d7e98c22d7AWS Secret Key51. secret_in_diff
bb1e6570bb1e6570Password in URL52. secret_in_diff
abc1d379abc1d379Password in URL53. secret_in_diff
5b4fc21b5b4fc21bPassword in URL54. secret_in_diff
346e92ba346e92baPassword in URL55. secret_in_diff
206fcf7b206fcf7bPassword in URL56. secret_in_diff
76553de576553de5Password in URL57. auth_flaw
backend/test_entity_investigation.pyexec_usage58. auth_flaw
backend/app/monitoring.pyexec_usage59. auth_flaw
backend/app/init_db.pyexec_usage60. auth_flaw
backend/app/deps.pyexec_usage61. auth_flaw
backend/app/tasks.pyexec_usage62. auth_flaw
backend/app/import_seed.pyexec_usage63. auth_flaw
backend/app/routers/monitoring.pyexec_usage64. auth_flaw
backend/app/routers/findings.pyexec_usage65. auth_flaw
backend/app/routers/leads.pyexec_usage66. auth_flaw
backend/app/routers/contacts.pyexec_usage67. auth_flaw
backend/app/routers/orgs.pyexec_usage68. auth_flaw
backend/app/routers/gather.pyexec_usage69. auth_flaw
backend/app/routers/entities.pyexec_usage70. auth_flaw
backend/app/routers/auth.pyexec_usage71. auth_flaw
backend/app/routers/sources.pyexec_usage72. auth_flaw
backend/app/routers/reports.pyexec_usage73. auth_flaw
backend/app/routers/cases.pyexec_usage74. auth_flaw
backend/app/routers/audit.pyexec_usage75. auth_flaw
backend/app/routers/people.pyexec_usage76. auth_flaw
backend/app/routers/dashboard.pyexec_usage77. auth_flaw
backend/app/routers/evidence.pyexec_usage78. auth_flaw
backend/app/routers/relationships.pyexec_usage79. auth_flaw
backend/app/routers/users.pyexec_usage80. auth_flaw
backend/app/routers/investigations.pyexec_usage81. auth_flaw
backend/app/routers/settings.pyexec_usage82. auth_flaw
backend/app/modules/osint_playbook.pyexec_usage83. auth_flaw
backend/app/modules/search_aggregator.pyexec_usage84. auth_flaw
backend/app/modules/dashboard_summary.pyexec_usage85. auth_flaw
backend/app/modules/local_deep_research.pyexec_usage86. auth_flaw
backend/app/services/case_access.pyexec_usage87. auth_flaw
backend/app/services/enrichment.pyexec_usage88. auth_flaw
backend/app/services/semantic_retrieval.pyexec_usage89. auth_flaw
backend/app/services/investigations/entity_extraction.pyexec_usage90. auth_flaw
backend/app/services/investigations/state_machine.pyexec_usage91. auth_flaw
backend/app/services/investigations/async_executor.pyexec_usage92. auth_flaw
backend/app/services/investigations/entity_tools.pyexec_usage93. auth_flaw
backend/app/services/investigations/entity_dispatcher.pyexec_usage94. auth_flaw
backend/app/services/investigations/orchestrator_enhanced.pyexec_usage95. auth_flaw
backend/app/services/investigations/llm_entity_extraction.pyexec_usage96. auth_flaw
backend/app/services/investigations/orchestrator_v3.pyeval_usage97. auth_flaw
backend/app/services/investigations/queue_manager.pyexec_usage98. auth_flaw
backend/app/services/investigations/scheduler.pyexec_usage99. auth_flaw
backend/app/services/investigations/orchestrator.pyexec_usage100. auth_flaw
backend/app/services/investigations/evidence_tracker.pyexec_usage101. auth_flaw
backend/app/services/investigations/pipeline/consolidator.pyexec_usage102. auth_flaw
backend/app/services/investigations/pipeline/executor.pyexec_usage103. auth_flaw
backend/app/services/investigations/pipeline/runner.pyexec_usage104. auth_flaw
backend/app/services/enrichment_pipeline/cache.pyexec_usage105. auth_flaw
backend/htmlcov/coverage_html_cb_dd2e7eb5.jsexec_usage106. auth_flaw
backend/tests/live_orchestrator_test.pyexec_usage107. auth_flaw
backend/tests/test_investigation_entity_tools.pyexec_usage108. auth_flaw
backend/tests/test_parse_evidence_api.pyexec_usage109. auth_flaw
backend/tests/performance/test_db_performance.pyexec_usage110. auth_flaw
backend/tests/integration/test_integration_module_flow.pyexec_usage111. auth_flaw
backend/tests/integration/test_integration_concurrent.pyexec_usage112. auth_flaw
backend/tests/integration/test_integration_workflow.pyexec_usage113. auth_flaw
backend/tests/integration/test_integration_resilience.pyexec_usage114. auth_flaw
backend/tests/integration/test_api_cases.pyexec_usage115. auth_flaw
backend/tests/integration/test_modules_integration.pyexec_usage116. auth_flaw
backend/tests/integration/test_api_reports.pyexec_usage117. auth_flaw
backend/tests/integration/test_api_auth.pyexec_usage118. auth_flaw
backend/tests/unit/test_evidence_review.pyexec_usage119. auth_flaw
backend/tests/unit/test_stress_full_pipeline.pyexec_usage120. auth_flaw
backend/tests/unit/test_auto_gather_consolidation.pyexec_usage121. auth_flaw
backend/tests/unit/test_module_benchmarks.pyexec_usage122. auth_flaw
backend/tests/unit/test_structured_golden_determinism.pyexec_usage123. auth_flaw
backend/tests/unit/test_llm_extraction_quality.pyexec_usage124. auth_flaw
.venv/lib/python3.12/site-packages/six.pyexec_usage125. auth_flaw
.venv/lib/python3.12/site-packages/typing_extensions.pyeval_usage126. auth_flaw
.venv/lib/python3.12/site-packages/wrapt/decorators.pyexec_usage127. auth_flaw
.venv/lib/python3.12/site-packages/redis/cluster.pyeval_usage128. auth_flaw
.venv/lib/python3.12/site-packages/redis/commands/core.pyeval_usage129. auth_flaw
.venv/lib/python3.12/site-packages/passlib/crypto/digest.pyeval_usage130. auth_flaw
.venv/lib/python3.12/site-packages/_pytest/skipping.pyeval_usage131. auth_flaw
.venv/lib/python3.12/site-packages/_pytest/pytester.pyeval_usage132. auth_flaw
.venv/lib/python3.12/site-packages/_pytest/_code/code.pyeval_usage133. auth_flaw
.venv/lib/python3.12/site-packages/_pytest/_py/path.pyexec_usage134. auth_flaw
.venv/lib/python3.12/site-packages/_pytest/mark/__init__.pyeval_usage135. auth_flaw
.venv/lib/python3.12/site-packages/_pytest/mark/expression.pyeval_usage136. auth_flaw
.venv/lib/python3.12/site-packages/_pytest/assertion/rewrite.pyexec_usage137. auth_flaw
.venv/lib/python3.12/site-packages/prometheus_client/decorator.pyexec_usage138. auth_flaw
.venv/lib/python3.12/site-packages/celery/utils/functional.pyexec_usage139. auth_flaw
.venv/lib/python3.12/site-packages/celery/backends/arangodb.pydisable_ssl_verify140. auth_flaw
.venv/lib/python3.12/site-packages/celery/backends/base.pyeval_usage141. auth_flaw
.venv/lib/python3.12/site-packages/pip/_internal/utils/setuptools_build.pyexec_usage142. auth_flaw
.venv/lib/python3.12/site-packages/pip/_internal/network/session.pydisable_ssl_verify143. auth_flaw
.venv/lib/python3.12/site-packages/pip/_vendor/six.pyexec_usage144. auth_flaw
.venv/lib/python3.12/site-packages/pip/_vendor/typing_extensions.pyeval_usage145. auth_flaw
.venv/lib/python3.12/site-packages/pip/_vendor/distlib/wheel.pydisable_ssl_verify146. auth_flaw
.venv/lib/python3.12/site-packages/pip/_vendor/pkg_resources/__init__.pyexec_usage147. auth_flaw
.venv/lib/python3.12/site-packages/pip/_vendor/pygments/formatters/__init__.pyeval_usage148. auth_flaw
.venv/lib/python3.12/site-packages/pip/_vendor/pygments/lexers/__init__.pyexec_usage149. auth_flaw
.venv/lib/python3.12/site-packages/pip/_vendor/pyparsing/results.pyeval_usage150. auth_flaw
.venv/lib/python3.12/site-packages/pip/_vendor/urllib3/packages/six.pyexec_usage151. auth_flaw
.venv/lib/python3.12/site-packages/pip/_vendor/urllib3/contrib/securetransport.pydisable_ssl_verify152. auth_flaw
.venv/lib/python3.12/site-packages/cffi/recompiler.pyeval_usage153. auth_flaw
.venv/lib/python3.12/site-packages/cffi/setuptools_ext.pyexec_usage154. auth_flaw
.venv/lib/python3.12/site-packages/billiard/managers.pyexec_usage155. auth_flaw
.venv/lib/python3.12/site-packages/billiard/sharedctypes.pyexec_usage156. auth_flaw
.venv/lib/python3.12/site-packages/jinja2/debug.pyexec_usage157. auth_flaw
.venv/lib/python3.12/site-packages/jinja2/nodes.pyeval_usage158. auth_flaw
.venv/lib/python3.12/site-packages/jinja2/environment.pyexec_usage159. auth_flaw
.venv/lib/python3.12/site-packages/pygments/formatters/__init__.pyeval_usage160. auth_flaw
.venv/lib/python3.12/site-packages/pygments/lexers/__init__.pyexec_usage161. auth_flaw
.venv/lib/python3.12/site-packages/pygments/lexers/_julia_builtins.pyeval_usage162. auth_flaw
.venv/lib/python3.12/site-packages/sqlmodel/ext/asyncio/session.pyexec_usage163. auth_flaw
.venv/lib/python3.12/site-packages/sqlmodel/sql/_expression_select_cls.pyexec_usage164. auth_flaw
.venv/lib/python3.12/site-packages/sqlmodel/orm/session.pyexec_usage165. auth_flaw
.venv/lib/python3.12/site-packages/typing_inspection/typing_objects.pyexec_usage166. auth_flaw
.venv/lib/python3.12/site-packages/anyio/to_interpreter.pyexec_usage167. auth_flaw
.venv/lib/python3.12/site-packages/sqlalchemy/sql/lambdas.pyexec_usage168. auth_flaw
.venv/lib/python3.12/site-packages/sqlalchemy/util/langhelpers.pyexec_usage169. auth_flaw
.venv/lib/python3.12/site-packages/sqlalchemy/util/typing.pyeval_usage170. auth_flaw
.venv/lib/python3.12/site-packages/sqlalchemy/testing/plugin/pytestplugin.pyexec_usage171. auth_flaw
.venv/lib/python3.12/site-packages/sqlalchemy/orm/instrumentation.pyexec_usage172. auth_flaw
.venv/lib/python3.12/site-packages/sqlalchemy/orm/clsregistry.pyeval_usage173. auth_flaw
.venv/lib/python3.12/site-packages/sqlalchemy/orm/_orm_constructors.pyeval_usage174. auth_flaw
.venv/lib/python3.12/site-packages/pydantic/_internal/_namespace_utils.pyeval_usage175. auth_flaw
.venv/lib/python3.12/site-packages/pydantic/_internal/_typing_extra.pyeval_usage176. auth_flaw
.venv/lib/python3.12/site-packages/pydantic/v1/utils.pyeval_usageThis issue was auto-generated by the security sweep cron job.
Investigated all 176 findings across 5 patterns:
• AWS Secret Key (43) — false positives from 40-char git SHAs in .gsd/ files. Fixed: removed .gsd/ from git tracking.
• exec_usage (92) + eval_usage (24) — code quality issues, not credential leaks.
• Password in URL (13) — postgresql:// URLs with *** already redacted. Not active leaks.
• disable_ssl_verify (4) — code quality issue.
No actual credentials were leaked. The exec/eval and SSL verify items should be filed as separate bugs if desired.