Scan report
yavihemant / digital-army-ai-honeypot
Could an attacker exploit mistakes in this code?
No issues of this kind were found.
- High
- 0
- Medium
- 0
- Low
- 1
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
Minor issues. Worth a glance, unlikely to be urgent.
- High
- 0
- Medium
- 6
- Low
- 0
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 6
- Uncertain
- 0
- Likely noise
- 1
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
6 findings likely need attention, 1 looks like noise. Most notable: Unpinned dependency: 'fastapi' has no version lock — supply chain risk in requirements.txt (54% confidence).
Detections by engine
Findings
Highest severity first. Select a finding to see the code and what it means.
-
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- requirements.txt line 1
- Likely real
- Yes, 54% confidence
Unpinned dependency: 'fastapi' has no version lock — supply chain risk
fastapi -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- requirements.txt line 2
- Likely real
- Yes, 54% confidence
Unpinned dependency: 'uvicorn' has no version lock — supply chain risk
uvicorn -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- requirements.txt line 3
- Likely real
- Yes, 54% confidence
Unpinned dependency: 'pydantic' has no version lock — supply chain risk
pydantic -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- requirements.txt line 4
- Likely real
- Yes, 54% confidence
Unpinned dependency: 'python-dotenv' has no version lock — supply chain risk
python-dotenv -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- requirements.txt line 5
- Likely real
- Yes, 54% confidence
Unpinned dependency: 'google-generativeai' has no version lock — supply chain risk
google-generativeai -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- requirements.txt line 6
- Likely real
- Yes, 54% confidence
Unpinned dependency: 'regex' has no version lock — supply chain risk
regex -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /logic_brain.py line 27
- Likely real
- Probably noise, 8% confidence
Standard pseudo-random generators are not suitable for security/cryptographic purposes.
26 except: 27 return random.choice([ 28 "Beta thoda simple me samjhao", 29 "Mujhe dar lag raha hai", 30 "Google Pay khol liya beta" 31 ])
No findings match these filters.