Trust and health report
QA-Pilot - trust report
Sourced, dated trust signals - maintenance label posture, repository provenance, and security scan status. Not a composite safety grade.
GraphCanon updated today · GitHub synced today
Maintenance
Recency and activity heuristics from public GitHub metadata (maintenance label, momentum); methodology: github_public_v1.
Slowing36% signal
last push 321d ago
Provenance
Repository identity and fork provenance (github_public_v1).
- GitHub repo id: 781254183
- Not a fork
- Personal account
- Computed today
Security scan
Dependency advisory security scan when a lockfile is present. Not a full code audit.
- Status
- 181 low
- Last scan
- today
- Scanner
- osv@v1
Findings
GHSA-2fqr-mr3j-6wp8
aiohttp@3.9.3 · requirements.txt
GHSA-2vrm-gr82-f7m5
aiohttp@3.9.3 · requirements.txt
GHSA-3wq7-rqq7-wx6j
aiohttp@3.9.3 · requirements.txt
GHSA-4fvr-rgm6-gqmc
aiohttp@3.9.3 · requirements.txt
GHSA-4m7w-qmgq-4wj5
aiohttp@3.9.3 · requirements.txt
GHSA-54jq-c3m8-4m76
aiohttp@3.9.3 · requirements.txt
GHSA-5m98-qgg9-wh84
aiohttp@3.9.3 · requirements.txt
GHSA-63hf-3vf5-4wqf
aiohttp@3.9.3 · requirements.txt
GHSA-63hw-fmq6-xxg2
aiohttp@3.9.3 · requirements.txt
GHSA-69f9-5gxw-wvc2
aiohttp@3.9.3 · requirements.txt
GHSA-6jhg-hg63-jvvf
aiohttp@3.9.3 · requirements.txt
GHSA-6mq8-rvhq-8wgg
aiohttp@3.9.3 · requirements.txt
GHSA-7gpw-8wmc-pm8g
aiohttp@3.9.3 · requirements.txt
GHSA-8495-4g3g-x7pr
aiohttp@3.9.3 · requirements.txt
GHSA-9548-qrrj-x5pj
aiohttp@3.9.3 · requirements.txt
GHSA-966j-vmvw-g2g9
aiohttp@3.9.3 · requirements.txt
GHSA-9x8q-7h8h-wcw9
aiohttp@3.9.3 · requirements.txt
GHSA-c427-h43c-vf67
aiohttp@3.9.3 · requirements.txt
GHSA-fh55-r93g-j68g
aiohttp@3.9.3 · requirements.txt
GHSA-g3cq-j2xw-wf74
aiohttp@3.9.3 · requirements.txt
GHSA-g84x-mcqj-x9qq
aiohttp@3.9.3 · requirements.txt
GHSA-hcc4-c3v8-rx92
aiohttp@3.9.3 · requirements.txt
GHSA-hg6j-4rv6-33pg
aiohttp@3.9.3 · requirements.txt
GHSA-hpj7-wq8m-9hgp
aiohttp@3.9.3 · requirements.txt
GHSA-jg22-mg44-37j8
aiohttp@3.9.3 · requirements.txt
GHSA-jj3x-wxrx-4x23
aiohttp@3.9.3 · requirements.txt
GHSA-m5qp-6w8w-w647
aiohttp@3.9.3 · requirements.txt
GHSA-m6qw-4cw2-hm4m
aiohttp@3.9.3 · requirements.txt
GHSA-mqqc-3gqh-h2x8
aiohttp@3.9.3 · requirements.txt
GHSA-mwh4-6h8g-pg8w
aiohttp@3.9.3 · requirements.txt
GHSA-p998-jp59-783m
aiohttp@3.9.3 · requirements.txt
GHSA-w2fm-2cpv-w7v5
aiohttp@3.9.3 · requirements.txt
GHSA-xcgm-r5h9-7989
aiohttp@3.9.3 · requirements.txt
PYSEC-2026-1097
aiohttp@3.9.3 · requirements.txt
PYSEC-2026-1098
aiohttp@3.9.3 · requirements.txt
PYSEC-2026-1099
aiohttp@3.9.3 · requirements.txt
PYSEC-2026-1100
aiohttp@3.9.3 · requirements.txt
PYSEC-2026-1101
aiohttp@3.9.3 · requirements.txt
PYSEC-2026-1102
aiohttp@3.9.3 · requirements.txt
PYSEC-2026-1103
aiohttp@3.9.3 · requirements.txt
PYSEC-2026-1104
aiohttp@3.9.3 · requirements.txt
PYSEC-2026-1105
aiohttp@3.9.3 · requirements.txt
PYSEC-2026-1106
aiohttp@3.9.3 · requirements.txt
PYSEC-2026-1107
aiohttp@3.9.3 · requirements.txt
PYSEC-2026-1109
aiohttp@3.9.3 · requirements.txt
PYSEC-2026-237
aiohttp@3.9.3 · requirements.txt
GHSA-248v-346w-9cwc
certifi@2024.2.2 · requirements.txt
PYSEC-2024-230
certifi@2024.2.2 · requirements.txt
GHSA-w8v5-vhqr-4h9v
diskcache@5.6.3 · requirements.txt
GHSA-qmgc-5h2g-mvrw
filelock@3.13.3 · requirements.txt
GHSA-w853-jp5j-5j7f
filelock@3.13.3 · requirements.txt
PYSEC-2026-1374
filelock@3.13.3 · requirements.txt
PYSEC-2026-1375
filelock@3.13.3 · requirements.txt
GHSA-68rp-wp8r-4726
Flask@3.0.3 · requirements.txt
GHSA-43qf-4rqw-9q2g
Flask-Cors@4.0.1 · requirements.txt
GHSA-7rxf-gvfg-47g4
Flask-Cors@4.0.1 · requirements.txt
GHSA-8vgw-p6qm-5gr7
Flask-Cors@4.0.1 · requirements.txt
GHSA-hxwh-jpp2-84pm
Flask-Cors@4.0.1 · requirements.txt
PYSEC-2024-71
Flask-Cors@4.0.1 · requirements.txt
PYSEC-2026-1383
Flask-Cors@4.0.1 · requirements.txt
PYSEC-2026-1384
Flask-Cors@4.0.1 · requirements.txt
PYSEC-2026-1385
Flask-Cors@4.0.1 · requirements.txt
GHSA-7545-fcxq-7j24
GitPython@3.1.42 · requirements.txt
GHSA-mv93-w799-cj2w
GitPython@3.1.42 · requirements.txt
GHSA-rpm5-65cw-6hj4
GitPython@3.1.42 · requirements.txt
GHSA-v87r-6q3f-2j67
GitPython@3.1.42 · requirements.txt
GHSA-x2qx-6953-8485
GitPython@3.1.42 · requirements.txt
GHSA-vqfr-h8mv-ghfj
h11@0.14.0 · requirements.txt
PYSEC-2026-348
h11@0.14.0 · requirements.txt
GHSA-65pc-fj4g-8rjx
idna@3.6 · requirements.txt
GHSA-jjg7-2v4v-x38h
idna@3.6 · requirements.txt
PYSEC-2024-60
idna@3.6 · requirements.txt
PYSEC-2026-215
idna@3.6 · requirements.txt
GHSA-cpwx-vrp4-4pq7
Jinja2@3.1.3 · requirements.txt
GHSA-gmj6-6f8f-6699
Jinja2@3.1.3 · requirements.txt
GHSA-h75v-3vvj-5mfj
Jinja2@3.1.3 · requirements.txt
GHSA-q2x7-8rv6-6q7h
Jinja2@3.1.3 · requirements.txt
PYSEC-2026-1471
Jinja2@3.1.3 · requirements.txt
PYSEC-2026-1472
Jinja2@3.1.3 · requirements.txt
PYSEC-2026-1474
Jinja2@3.1.3 · requirements.txt
PYSEC-2026-1475
Jinja2@3.1.3 · requirements.txt
GHSA-3644-q5cj-c5c7
langchain@0.2.6 · requirements.txt
GHSA-gr75-jv2w-4656
langchain@0.2.6 · requirements.txt
GHSA-45pg-36p6-83v9
langchain-community@0.2.6 · requirements.txt
GHSA-pc6w-59fv-rh23
langchain-community@0.2.6 · requirements.txt
GHSA-q25c-c977-4cmh
langchain-community@0.2.6 · requirements.txt
PYSEC-2024-115
langchain-community@0.2.6 · requirements.txt
PYSEC-2026-1515
langchain-community@0.2.6 · requirements.txt
PYSEC-2026-1516
langchain-community@0.2.6 · requirements.txt
GHSA-2g6r-c272-w58r
langchain-core@0.2.11 · requirements.txt
GHSA-5chr-fjjv-38qv
langchain-core@0.2.11 · requirements.txt
GHSA-6qv9-48xg-fc7f
langchain-core@0.2.11 · requirements.txt
GHSA-926x-3r5x-gfhw
langchain-core@0.2.11 · requirements.txt
GHSA-c67j-w6g6-q2cm
langchain-core@0.2.11 · requirements.txt
GHSA-pjwx-r37v-7724
langchain-core@0.2.11 · requirements.txt
GHSA-qh6h-p6c9-ff54
langchain-core@0.2.11 · requirements.txt
PYSEC-2026-1517
langchain-core@0.2.11 · requirements.txt
PYSEC-2026-1518
langchain-core@0.2.11 · requirements.txt
PYSEC-2026-373
langchain-core@0.2.11 · requirements.txt
GHSA-r7w7-9xr2-qq2r
langchain-openai@0.1.8 · requirements.txt
PYSEC-2026-76
langchain-openai@0.1.8 · requirements.txt
GHSA-fv5p-p927-qmxr
langchain-text-splitters@0.2.1 · requirements.txt
GHSA-m42m-m8cr-8m58
langchain-text-splitters@0.2.1 · requirements.txt
PYSEC-2026-1520
langchain-text-splitters@0.2.1 · requirements.txt
PYSEC-2026-77
langchain-text-splitters@0.2.1 · requirements.txt
GHSA-f4xh-w4cj-qxq8
langsmith@0.1.80 · requirements.txt
GHSA-rr7j-v2q5-chgv
langsmith@0.1.80 · requirements.txt
GHSA-3wxx-q3gv-pvvv
llama-index-core@0.10.43.post1 · requirements.txt
GHSA-488g-hw5f-x29p
llama-index-core@0.10.43.post1 · requirements.txt
GHSA-7753-xrfw-ch36
llama-index-core@0.10.43.post1 · requirements.txt
GHSA-cr7q-2w66-hjcm
llama-index-core@0.10.43.post1 · requirements.txt
GHSA-j3wr-m6xh-64hg
llama-index-core@0.10.43.post1 · requirements.txt
PYSEC-2026-1559
llama-index-core@0.10.43.post1 · requirements.txt
PYSEC-2026-1560
llama-index-core@0.10.43.post1 · requirements.txt
PYSEC-2026-1561
llama-index-core@0.10.43.post1 · requirements.txt
PYSEC-2026-1562
llama-index-core@0.10.43.post1 · requirements.txt
PYSEC-2026-1563
llama-index-core@0.10.43.post1 · requirements.txt
GHSA-56xg-wfcc-g829
llama_cpp_python@0.2.67 · requirements.txt
PYSEC-2026-392
llama_cpp_python@0.2.67 · requirements.txt
GHSA-428g-f7cq-pgp5
marshmallow@3.21.1 · requirements.txt
PYSEC-2026-1605
marshmallow@3.21.1 · requirements.txt
GHSA-469j-vmhf-r6v7
nltk@3.8.1 · requirements.txt
GHSA-68j8-pq59-fqgm
nltk@3.8.1 · requirements.txt
GHSA-7p94-766c-hgjp
nltk@3.8.1 · requirements.txt
GHSA-cgvx-9447-vcch
nltk@3.8.1 · requirements.txt
GHSA-gfwx-w7gr-fvh7
nltk@3.8.1 · requirements.txt
GHSA-h8wq-7xc4-p3qx
nltk@3.8.1 · requirements.txt
GHSA-jm6w-m3j8-898g
nltk@3.8.1 · requirements.txt
GHSA-p4gq-832x-fm9v
nltk@3.8.1 · requirements.txt
GHSA-rf74-v2fm-23pw
nltk@3.8.1 · requirements.txt
PYSEC-2024-167
nltk@3.8.1 · requirements.txt
PYSEC-2026-2078
nltk@3.8.1 · requirements.txt
PYSEC-2026-2085
nltk@3.8.1 · requirements.txt
PYSEC-2026-597
nltk@3.8.1 · requirements.txt
PYSEC-2026-96
nltk@3.8.1 · requirements.txt
PYSEC-2026-97
nltk@3.8.1 · requirements.txt
PYSEC-2026-98
nltk@3.8.1 · requirements.txt
PYSEC-2026-99
nltk@3.8.1 · requirements.txt
GHSA-hx9q-6w63-j58v
orjson@3.9.15 · requirements.txt
PYSEC-2026-107
orjson@3.9.15 · requirements.txt
GHSA-44wm-f244-xhp3
pillow@10.2.0 · requirements.txt
GHSA-r73j-pqj5-w3x7
pillow@10.2.0 · requirements.txt
GHSA-wjx4-4jcj-g98j
pillow@10.2.0 · requirements.txt
PYSEC-2026-165
pillow@10.2.0 · requirements.txt
PYSEC-2026-1793
pillow@10.2.0 · requirements.txt
GHSA-7gcm-g887-7qv7
protobuf@4.25.3 · requirements.txt
GHSA-8qvm-5x2c-j2w7
protobuf@4.25.3 · requirements.txt
PYSEC-2026-1805
protobuf@4.25.3 · requirements.txt
PYSEC-2026-1806
protobuf@4.25.3 · requirements.txt
GHSA-rgxp-2hwp-jwgg
pyarrow@15.0.2 · requirements.txt
PYSEC-2024-161
pyarrow@15.0.2 · requirements.txt
PYSEC-2026-113
pyarrow@15.0.2 · requirements.txt
GHSA-jr27-m4p2-rc6r
pyasn1@0.6.0 · requirements.txt
GHSA-5239-wwwm-4pmq
Pygments@2.17.2 · requirements.txt
GHSA-752w-5fwx-jx9f
PyJWT@2.8.0 · requirements.txt
GHSA-993g-76c3-p5m4
PyJWT@2.8.0 · requirements.txt
GHSA-fhv5-28vv-h8m8
PyJWT@2.8.0 · requirements.txt
GHSA-w7vc-732c-9m39
PyJWT@2.8.0 · requirements.txt
GHSA-xgmm-8j9v-c9wx
PyJWT@2.8.0 · requirements.txt
PYSEC-2025-183
PyJWT@2.8.0 · requirements.txt
PYSEC-2026-120
PyJWT@2.8.0 · requirements.txt
PYSEC-2026-175
PyJWT@2.8.0 · requirements.txt
PYSEC-2026-177
PyJWT@2.8.0 · requirements.txt
PYSEC-2026-178
PyJWT@2.8.0 · requirements.txt
PYSEC-2026-179
PyJWT@2.8.0 · requirements.txt
GHSA-mf9w-mj56-hr94
python-dotenv@1.0.1 · requirements.txt
GHSA-59g5-xgcq-4qw3
python-multipart@0.0.9 · requirements.txt
GHSA-5rvq-cxj2-64vf
python-multipart@0.0.9 · requirements.txt
GHSA-6jv3-5f52-599m
python-multipart@0.0.9 · requirements.txt
GHSA-mj87-hwqh-73pj
python-multipart@0.0.9 · requirements.txt
GHSA-pp6c-gr5w-3c5g
python-multipart@0.0.9 · requirements.txt
GHSA-v9pg-7xvm-68hf
python-multipart@0.0.9 · requirements.txt
GHSA-vffw-93wf-4j4q
python-multipart@0.0.9 · requirements.txt
GHSA-wp53-j4wj-2cfg
python-multipart@0.0.9 · requirements.txt
PYSEC-2026-1851
python-multipart@0.0.9 · requirements.txt
PYSEC-2026-1852
python-multipart@0.0.9 · requirements.txt
GHSA-9hjg-9r4m-mvj7
requests@2.31.0 · requirements.txt
GHSA-9wx4-h78v-vm56
requests@2.31.0 · requirements.txt
GHSA-gc5v-m9x4-r6x2
requests@2.31.0 · requirements.txt
PYSEC-2026-1872
requests@2.31.0 · requirements.txt
PYSEC-2026-1873
requests@2.31.0 · requirements.txt
Method and caveats:these are sourced, dated heuristics from public GitHub data and optional dependency scans. A status like "no criticals found on 2026-07-11" is not a guarantee of safety. Read the full trust methodology · JSON report at /api/graphcanon/tools/reid41-qa-pilot/trust.
Common questions
- Is QA-Pilot maintained?
- GraphCanon rates QA-Pilot "Slowing" (36% maintenance signal from public GitHub metadata, computed today). Last push was 321 days ago. This is a recency heuristic, not a guarantee the project will stay maintained.
- Is QA-Pilot safe to use?
- Last scanned today (deps profile). Status: 181 low - 181 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report. GraphCanon does not certify QA-Pilot as safe - review maintenance, provenance, and scan findings on this page before adopting.
- Is QA-Pilot a fork?
- No. QA-Pilot is not flagged as a fork in GitHub metadata at the time of the last refresh.
- Does QA-Pilot have known security vulnerabilities?
- Last scanned today (deps profile). Status: 181 low - 181 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report.
- How often is the QA-Pilot trust report updated?
- Trust signals refresh on GitHub ingest/refresh cycles and optional dependency/MCP scans. This report was computed today (methodology github_public_v1).
- What does GraphCanon never claim about QA-Pilot?
- We never publish a composite safety grade, pen-test endorsement, or "verified secure" label for QA-Pilot. Signals are sourced heuristics with explicit limits - see trust methodology.
- How does GraphCanon assess trust for QA-Pilot?
- Signals are sourced from public GitHub metadata and optional dependency/MCP manifest scans, each tagged with methodology version and computed date. GraphCanon does not publish a composite safety grade. Read trust methodology for full scope and limits.