epicserve / django-base-site

1. high Semgrep A `run:` step pipes the output of `curl` or `wget` directly into a shell interpreter. This is the "curl | bash" install pattern — if the remote server is compromised or the URL is hijacked, an attacker can execute arbitrary code in your CI runner. Consider downloading the file first, verifying its checksum or signature, and then executing it. /.github/workflows/ci.yml:24 99%
2. high Semgrep A `run:` step pipes the output of `curl` or `wget` directly into a shell interpreter. This is the "curl | bash" install pattern — if the remote server is compromised or the URL is hijacked, an attacker can execute arbitrary code in your CI runner. Consider downloading the file first, verifying its checksum or signature, and then executing it. /.github/workflows/ci.yml:72 99%
3. high Semgrep A `run:` step pipes the output of `curl` or `wget` directly into a shell interpreter. This is the "curl | bash" install pattern — if the remote server is compromised or the URL is hijacked, an attacker can execute arbitrary code in your CI runner. Consider downloading the file first, verifying its checksum or signature, and then executing it. /.github/workflows/ci.yml:141 99%
4. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /.github/workflows/ci.yml 1%
5. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /config/bash/django_bash_completion 0%
6. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /config/docker/Dockerfile.web 0%
7. medium Semgrep 'mark_safe()' is used to mark a string as "safe" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead. /apps/base/templatetags/accounts.py:21 100%
8. medium Semgrep 'mark_safe()' is used to mark a string as "safe" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead. /apps/base/templatetags/accounts.py:42 100%
9. medium Semgrep 'mark_safe()' is used to mark a string as "safe" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead. /apps/base/templatetags/vite.py:55 100%
10. medium Semgrep 'mark_safe()' is used to mark a string as "safe" for HTML output. This disables escaping and could therefore subject the content to XSS attacks. Use 'django.utils.html.format_html()' to build HTML for rendering instead. /apps/base/templatetags/vite.py:59 100%
11. medium Semgrep This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown /.github/dependabot.yml:16 99%
12. medium Semgrep This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown /.github/dependabot.yml:9 99%
13. medium Semgrep This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown /.github/dependabot.yml:28 99%
14. medium Semgrep This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown /.github/dependabot.yml:40 99%
15. medium Semgrep Detected Flask route directly returning a formatted string. This is subject to cross-site scripting if user input can reach the string. Consider using the template engine instead and rendering pages with 'render_template()'. /apps/base/ninja_pagination.py:75 99%
16. medium Bandit Potential XSS on mark_safe function. /apps/base/templatetags/accounts.py:21 98%
17. medium Bandit Potential XSS on mark_safe function. /apps/base/templatetags/accounts.py:42 98%
18. medium Bandit Potential XSS on mark_safe function. /apps/base/templatetags/vite.py:55 98%
19. medium Bandit Potential XSS on mark_safe function. /apps/base/templatetags/vite.py:59 98%
20. medium Bandit Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed. /apps/base/templatetags/accounts.py:21 98%
21. medium Bandit Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed. /apps/base/templatetags/accounts.py:42 98%
22. medium Bandit Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed. /apps/base/templatetags/vite.py:55 98%
23. medium Bandit Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed. /apps/base/templatetags/vite.py:59 98%
24. medium Semgrep Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code. /apps/accounts/templates/account/email/unknown_account_message.html:18 98%
25. medium Semgrep Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code. /apps/accounts/templates/account/email/password_reset_key_message.html:18 98%
26. medium Semgrep Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code. /apps/accounts/templates/account/email/email_confirmation_message.html:19 98%
27. medium Semgrep Detected a template block where autoescaping is explicitly disabled with '{% autoescape off %}'. This allows rendering of raw HTML in this segment. Turn autoescaping on to prevent cross-site scripting (XSS). If you must do this, consider instead, using `mark_safe` in Python code. /apps/accounts/templates/account/email/account_already_exists_message.html:18 98%
28. medium GuardDog Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] /config/settings/_base.py:26 96%
29. medium Semgrep Detected usage of @csrf_exempt, which indicates that there is no CSRF token set for this route. This could lead to an attacker manipulating the user's account and exfiltration of private data. Instead, create a function without this decorator. /apps/billing/webhooks.py:144 95%
30. medium Dependency checker Unpinned dependency: 'pillow' has no version lock — supply chain risk pyproject.toml 54%
31. medium Dependency checker Unpinned dependency: 'django' has no version lock — supply chain risk pyproject.toml 54%
32. medium Dependency checker Unpinned dependency: 'boto3' has no version lock — supply chain risk pyproject.toml 54%
33. medium Dependency checker Unpinned dependency: 'celery' has no version lock — supply chain risk pyproject.toml 54%
34. medium Dependency checker Unpinned dependency: 'fido2' has no version lock — supply chain risk pyproject.toml 54%
35. medium Dependency checker Unpinned dependency: 'hiredis' has no version lock — supply chain risk pyproject.toml 54%
36. medium Dependency checker Unpinned dependency: 'python-json-logger' has no version lock — supply chain risk pyproject.toml 54%
37. medium Dependency checker Unpinned dependency: 'django-alive' has no version lock — supply chain risk pyproject.toml 54%
38. medium Dependency checker Unpinned dependency: 'django-allauth' has no version lock — supply chain risk pyproject.toml 54%
39. medium Dependency checker Unpinned dependency: 'django-hijack' has no version lock — supply chain risk pyproject.toml 54%
40. medium Dependency checker Unpinned dependency: 'django-maintenance-mode' has no version lock — supply chain risk pyproject.toml 54%
41. medium Dependency checker Unpinned dependency: 'django-ninja' has no version lock — supply chain risk pyproject.toml 54%
42. medium Dependency checker Unpinned dependency: 'django-storages' has no version lock — supply chain risk pyproject.toml 54%
43. medium Dependency checker Unpinned dependency: 'epicenv' has no version lock — supply chain risk pyproject.toml 54%
44. medium Dependency checker Unpinned dependency: 'psycopg2-binary' has no version lock — supply chain risk pyproject.toml 54%
45. medium Dependency checker Unpinned dependency: 'django-ses' has no version lock — supply chain risk pyproject.toml 54%
46. medium Dependency checker Unpinned dependency: 'whitenoise' has no version lock — supply chain risk pyproject.toml 54%
47. medium Dependency checker Unpinned dependency: 'gunicorn' has no version lock — supply chain risk pyproject.toml 53%
48. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/ci.yml:80 52%
49. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/ci.yml:70 52%
50. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/ci.yml:28 52%
51. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/ci.yml:26 52%
52. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/ci.yml:22 52%
53. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/ci.yml:139 52%
54. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/password_changed_subject.txt:3 99%
55. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/password_changed_message.html:6 99%
56. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/login_code_subject.txt:3 99%
57. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/email_deleted_subject.txt:3 99%
58. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/email_confirmation_subject.txt:3 99%
59. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/email_confirm_subject.txt:3 99%
60. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/email_confirm_message.html:6 99%
61. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/email_changed_subject.txt:3 99%
62. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/account_already_exists_subject.txt:3 99%
63. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/password_reset_code_subject.txt:3 99%
64. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/password_reset_key_subject.txt:3 99%
65. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/password_reset_message.html:6 99%
66. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/password_reset_subject.txt:3 99%
67. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/password_set_message.html:6 99%
68. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/password_set_subject.txt:3 99%
69. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/unknown_account_subject.txt:3 99%
70. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/password_reset_code_message.html:13 98%
71. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/email_changed_message.txt:4 98%
72. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/email_confirm_message.txt:4 98%
73. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/email_confirmation_message.txt:7 98%
74. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/email_confirmation_message.txt:9 98%
75. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/email_deleted_message.html:6 98%
76. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/email_deleted_message.txt:4 98%
77. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/login_code_message.html:7 98%
78. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/login_code_message.html:13 98%
79. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/login_code_message.txt:5 98%
80. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/login_code_message.txt:9 98%
81. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/password_changed_message.txt:4 98%
82. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/password_reset_code_message.html:7 98%
83. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/email_changed_message.html:6 98%
84. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/password_reset_code_message.txt:9 98%
85. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/password_reset_key_message.html:20 98%
86. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/password_reset_key_message.html:25 98%
87. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/password_reset_key_message.txt:4 98%
88. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/password_reset_key_message.txt:9 98%
89. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/password_reset_message.txt:4 98%
90. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/password_set_message.txt:4 98%
91. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/unknown_account_message.html:23 98%
92. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/unknown_account_message.html:26 98%
93. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/unknown_account_message.txt:6 98%
94. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/unknown_account_message.txt:8 98%
95. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/base_notification.txt:10 98%
96. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/base_notification.txt:5 98%
97. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/base_notification.html:14 98%
98. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/base_notification.html:7 98%
99. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/base_message.txt:5 98%
100. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/base_message.txt:1 98%
101. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/account_already_exists_message.txt:4 98%
102. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/account_already_exists_message.html:20 98%
103. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/password_reset_code_message.txt:5 98%
104. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/unknown_account_message.html:20 98%
105. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/unknown_account_message.txt:4 98%
106. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/email_confirmation_message.txt:5 98%
107. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/email_confirmation_message.html:20 98%
108. low Semgrep Translated strings will not be escaped when rendered in a template. This leads to a vulnerability where translators could include malicious script tags in their translations. Consider using `force_escape` to explicitly escape a translated text. /apps/accounts/templates/account/email/account_already_exists_message.html:24 98%
109. low Bandit Possible hardcoded password: '/accounts/password/reset/key/{key}' /config/settings/_base.py:381 85%
110. low Bandit Consider possible security implications associated with the subprocess module. /.agents/skills/weekly-maintenance/scripts/merge_dependabot.py:30 13%
111. low Bandit Consider possible security implications associated with the subprocess module. /.agents/skills/weekly-maintenance/scripts/dependabot_report.py:17 13%
112. low Bandit Starting a process with a partial executable path /.agents/skills/weekly-maintenance/scripts/merge_dependabot.py:61 12%
113. low Bandit Starting a process with a partial executable path /.agents/skills/weekly-maintenance/scripts/dependabot_report.py:37 12%
114. low Bandit subprocess call - check for execution of untrusted input. /.agents/skills/weekly-maintenance/scripts/merge_dependabot.py:61 3%
115. low Bandit subprocess call - check for execution of untrusted input. /.agents/skills/weekly-maintenance/scripts/dependabot_report.py:37 3%
116. low Dependency checker Loose version constraint: 'redis>=7.1,<9.0' — attacker could push malicious update pyproject.toml 2%
117. low Dependency checker Loose version constraint: 'vue-router^5.3.1' — attacker could push malicious update package.json 2%
118. low Dependency checker Loose version constraint: 'stripe>=14,<16' — attacker could push malicious update pyproject.toml 2%
119. low Dependency checker Loose version constraint: '@heroicons/vue^2.2.0' — attacker could push malicious update package.json 2%
120. low Dependency checker Loose version constraint: 'vite^8.3.0' — attacker could push malicious update package.json 2%
121. low Dependency checker Loose version constraint: 'vue-advanced-cropper^2.8.9' — attacker could push malicious update package.json 2%
122. low Dependency checker Loose version constraint: 'vue^3.5.42' — attacker could push malicious update package.json 2%
123. low Dependency checker Loose version constraint: 'tailwindcss^4.3.3' — attacker could push malicious update package.json 2%
124. low Dependency checker Loose version constraint: 'reka-ui^2.10.4' — attacker could push malicious update package.json 2%
125. low Dependency checker Loose version constraint: '@vitejs/plugin-vue^6.0.9' — attacker could push malicious update package.json 2%
126. low Dependency checker Loose version constraint: '@tailwindcss/vite^4.3.3' — attacker could push malicious update package.json 2%
127. low Bandit Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. /apps/organizations/middleware.py:17 0%
128. low Bandit Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. /apps/organizations/apps.py:10 0%

No findings match these filters. Clear filters