<< Back to security report

──peterhajas/dotfiles/tw — semgrep Scan

Repositorypeterhajas/dotfiles →

Commit183b7e8 →

VerdictFAIL

Score60

DateMay 29, 2026

──Findings

Severity	Rule	Message	File:Line
MEDIUM	python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1	Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.	peterhajas/dotfiles/tw-ff6419cf/tiddlywiki/bin/tiddlywiki_diff_tiddlers:52 →
HIGH	python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args	Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'.	peterhajas/dotfiles/tw-ff6419cf/utils/bin/scad2usdz:500 →
HIGH	python.lang.security.audit.dangerous-subprocess-use-tainted-env-args.dangerous-subprocess-use-tainted-env-args	Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'.	peterhajas/dotfiles/tw-ff6419cf/utils/bin/scad2usdz:519 →
MEDIUM	python.lang.security.audit.exec-detected.exec-detected	Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.	peterhajas/dotfiles/tw-ff6419cf/yabai/bin/test_yabai_update_tiling.py:36 →