Skip to content
Tools / beaverhabits / Security

Security Deep Dive

beaverhabits

Security posture and CVE patch evidence from tracked releases.

Back to Tool

3 high-severity dependency CVEs affects v0.9.1.

Review the dependency vulnerabilities below.

— Signed — SLSA — SBOM ✗ Security policy Monthly cadence · 30d median Active maintainer

Trust Signals — 2 of 9 Present

Evidence already collected from releases and repository metadata.

2/9 Present
Signed releases Unknown
Latest release artifact signature Latest release
SLSA provenance Unknown
Attestation predicate level Latest release
SBOM published Unknown
GitHub SBOM API Latest release
SECURITY.md Absent
GitHub repository metadata Repository policy
Checked: 18d ago
Release cadence: monthly Present
30d median over recent releases Release history
Latest release: 14d ago
Maintainer active Present
Recent commit activity Repository
Last commit: 14d ago
Checksums (SHA256SUMS) Not active yet
SHA256SUMS or equivalent Release asset
Latest release: 14d ago
GitHub Actions attestation Not active yet
actions/attest-build-provenance Workflow file
Latest release: 14d ago
Signing assets Not active yet
.sig, .crt, cosign.pub, or similar Release asset
Latest release: 14d ago
5.1/10 Security Score
Dependency Exposure 27 transitive dependency CVEs found in the latest SBOM.

Security Score

A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.

epss

0.25 / 0.5

No EPSS data

freshness

1.00 / 1.0

14d stale

scorecard

2.00 / 4.0

⚠ Estimated — not yet collected

cve health

0.50 / 2.5

⚠ No direct scan — 0c/3h transitive CVEs

patch speed

0.50 / 0.5

⚠ Estimated — no CVE patch history

kev exposure

1.50 / 1.5

No KEV exposure

supply chain risk

-0.66 / 10.0

Risk 6.5/100

Score breakdown

schema v2

Vulnerability posture

vulnerability posture

2.0

25%

direct cves: clear cve scan: estimated

Release responsiveness

release responsiveness

10.0

5%

patch speed days: no_history

Dependency exposure

dependency exposure

9.3

10%

supply chain risk: 6.55 transitive cves: 0c/3h

Provenance trust

provenance trust

5.0

40%

scorecard score: estimated openssf badge: none

Maintainer health

maintainer health

10.0

10%

activity freshness: 14d

Operational risk

operational risk

8.5

10%

kev exposure: clear epss max: none
How is this calculated?

The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.

Supply Chain Risk

Risk 6.5/100
0 Transitive critical CVEs
0 KEV-transitive CVEs
72% Dependency freshness

OpenSSF Badge

OpenSSF none

Badge indicates adherence to open-source best practices.

Dependency Vulnerabilities

184 dependencies scanned View full dependency list →

Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.

Critical

0

High

3

Medium

16

Low

8

Unknown

0

High 3 Medium 16 Low 8
CVE Severity KEV Dependency Affected version Cleared in release
CVE-2026-24486 high python-multipart 0.0.20 v0.9.1
CVE-2026-32597 high pyjwt 2.10.1 v0.9.1
CVE-2026-42561 high python-multipart 0.0.20 v0.9.1
CVE-2025-68481 medium fastapi-users 14.0.2 v0.9.1
CVE-2025-71176 medium pytest 8.4.2 v0.9.1
CVE-2026-22815 medium aiohttp 3.13.3 v0.9.1
CVE-2026-25645 medium requests 2.32.5 v0.9.1
CVE-2026-27156 medium nicegui 3.7.1 v0.9.1
CVE-2026-3219 medium pip 26.0.1 v0.9.1
CVE-2026-33332 medium nicegui 3.7.1 v0.9.1
CVE-2026-34450 medium anthropic 0.86.0 v0.9.1
CVE-2026-34452 medium anthropic 0.86.0 v0.9.1
CVE-2026-34515 medium aiohttp 3.13.3 v0.9.1
CVE-2026-34516 medium aiohttp 3.13.3 v0.9.1
CVE-2026-34525 medium aiohttp 3.13.3 v0.9.1
CVE-2026-39844 medium nicegui 3.7.1 v0.9.1
CVE-2026-39892 medium cryptography 46.0.5 v0.9.1
CVE-2026-40347 medium python-multipart 0.0.20 v0.9.1
CVE-2026-6357 medium pip 26.0.1 v0.9.1
CVE-2026-34073 low cryptography 46.0.5 v0.9.1
CVE-2026-34513 low aiohttp 3.13.3 v0.9.1
CVE-2026-34514 low aiohttp 3.13.3 v0.9.1
CVE-2026-34517 low aiohttp 3.13.3 v0.9.1
CVE-2026-34518 low aiohttp 3.13.3 v0.9.1
CVE-2026-34519 low aiohttp 3.13.3 v0.9.1
CVE-2026-34520 low aiohttp 3.13.3 v0.9.1
CVE-2026-4539 low pygments 2.19.2 v0.9.1

Showing 27 of 27

Beta — feedback welcome: [email protected]