low Permission: env_vars access detected permission_analyzer · 90%
info SBOM generated: 422 components sbom_generator · 100%
low Tool 'analyze_stock' has no annotations annotation_checker · 100%
low Tool 'optimize_portfolio' has no annotations annotation_checker · 100%
low Tool 'forecast_market_trends' has no annotations annotation_checker · 100%
low Tool 'analyze_economic_indicator' has no annotations annotation_checker · 100%
low Tool 'generate_investment_report' has no annotations annotation_checker · 100%
low Tool 'list_tool_groups' has no annotations annotation_checker · 100%
low Tool 'enable_tool_group' has no annotations annotation_checker · 100%
low Tool 'describeSqlSchema' has no annotations annotation_checker · 100%
low Tool 'executeSql' has no annotations annotation_checker · 100%
low Tool 'whoami' has no annotations annotation_checker · 100%
low Tool 'f' has no annotations annotation_checker · 100%
low Tool 'x' has no annotations annotation_checker · 100%
low Tool 'anything' has no annotations annotation_checker · 100%
high Hardcoded OAuth client ID in Arize-ai-phoenix-49cf5a7/tests/unit/server/api/routers/test_oauth2.py auth_checker · 85%
high Hardcoded OAuth client secret in Arize-ai-phoenix-49cf5a7/tests/unit/server/api/routers/test_oauth2.py auth_checker · 95%
high Hardcoded OAuth client secret in Arize-ai-phoenix-49cf5a7/tests/unit/server/api/mutations/test_generative_model_custom_provider_mutations.py auth_checker · 95%
high Hardcoded OAuth client ID in Arize-ai-phoenix-49cf5a7/js/app/tests/oauth2-consent.spec.ts auth_checker · 85%
info Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium Excessive dependency count: 451 direct dependencies dependency_analyzer · 90%
medium Suspicious package name: react-dom dependency_analyzer · 60%
medium Suspicious package name: react-aria dependency_analyzer · 60%
medium Suspicious package name: react-relay dependency_analyzer · 60%
medium Suspicious package name: react-resizable dependency_analyzer · 60%
medium Suspicious package name: react-router dependency_analyzer · 60%
medium Suspicious package name: react-stately dependency_analyzer · 60%
medium Vulnerable dependency: @hono/node-server@2.0.8 (GHSA-9mqv-5hh9-4cgg) dependency_analyzer · 95%
medium Vulnerable dependency: hono@4.12.29 (GHSA-54fx-42gc-7vw4) dependency_analyzer · 95%
medium Vulnerable dependency: hono@4.12.29 (GHSA-79qm-7rj5-m7r9) dependency_analyzer · 95%
medium Vulnerable dependency: hono@4.12.29 (GHSA-8j4g-w8fx-2239) dependency_analyzer · 95%
medium Vulnerable dependency: hono@4.12.29 (GHSA-f23p-vx2j-j53r) dependency_analyzer · 95%
medium Vulnerable dependency: @fastify/static@9.3.0 (GHSA-83w8-p2f5-377r) dependency_analyzer · 95%
medium Vulnerable dependency: @fastify/static@9.3.0 (GHSA-8pvw-jcv7-9cmj) dependency_analyzer · 95%
medium Vulnerable dependency: postcss@8.5.16 (GHSA-fxqj-rqcc-2cmp) dependency_analyzer · 95%
medium Vulnerable dependency: postcss@8.5.16 (GHSA-r28c-9q8g-f849) dependency_analyzer · 95%
medium Vulnerable dependency: datasets@2.0 (PYSEC-2026-3716) dependency_analyzer · 95%
medium Vulnerable dependency: langgraph@0.2 (GHSA-g48c-2wqr-h844) dependency_analyzer · 95%
medium Vulnerable dependency: langgraph@0.2 (PYSEC-2026-2194) dependency_analyzer · 95%
medium Vulnerable dependency: langgraph@0.2 (PYSEC-2026-83) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-openai@0.3 (GHSA-r7w7-9xr2-qq2r) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-openai@0.3 (PYSEC-2026-76) dependency_analyzer · 95%
medium Vulnerable dependency: langchain@1.0.0 (GHSA-gr75-jv2w-4656) dependency_analyzer · 95%
medium Vulnerable dependency: langchain@1.0.0 (PYSEC-2026-2192) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (GHSA-2g6r-c272-w58r) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (GHSA-6qv9-48xg-fc7f) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (GHSA-926x-3r5x-gfhw) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (GHSA-c67j-w6g6-q2cm) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (GHSA-pjwx-r37v-7724) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (GHSA-qh6h-p6c9-ff54) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (PYSEC-2026-1518) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (PYSEC-2026-2193) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (PYSEC-2026-2562) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (PYSEC-2026-2563) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (PYSEC-2026-2564) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (PYSEC-2026-373) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-openai@1.0.0 (GHSA-r7w7-9xr2-qq2r) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-openai@1.0.0 (PYSEC-2026-76) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-text-splitters@1.0.0 (GHSA-fv5p-p927-qmxr) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-text-splitters@1.0.0 (PYSEC-2026-77) dependency_analyzer · 95%
medium Vulnerable dependency: langgraph@1.0.0 (GHSA-g48c-2wqr-h844) dependency_analyzer · 95%
medium Vulnerable dependency: langgraph@1.0.0 (PYSEC-2026-83) dependency_analyzer · 95%
medium Vulnerable dependency: gradio@6.15.1 (PYSEC-2026-2179) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-anthropic@1.0.0 (GHSA-gr75-jv2w-4656) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-anthropic@1.0.0 (PYSEC-2026-2556) dependency_analyzer · 95%
medium Vulnerable dependency: pandas@1.0 (PYSEC-2020-73) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (GHSA-2c2j-9gv5-cj73) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (GHSA-82w8-qh3p-5jfq) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (GHSA-86qp-5c8j-p5mr) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (GHSA-f96h-pmfr-66vw) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (GHSA-jp82-jpqv-5vv3) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (GHSA-wqp7-x3pw-xc5r) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (GHSA-x746-7m8f-x49c) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (PYSEC-2026-161) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (PYSEC-2026-1941) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (PYSEC-2026-1943) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (PYSEC-2026-2280) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (PYSEC-2026-2281) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (PYSEC-2026-248) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (PYSEC-2026-249) dependency_analyzer · 95%
medium Vulnerable dependency: pydantic@2.1.0 (GHSA-mr82-8j83-vxmv) dependency_analyzer · 95%
medium Vulnerable dependency: pydantic@2.1.0 (PYSEC-2026-1812) dependency_analyzer · 95%
medium Vulnerable dependency: authlib@1.7.0 (GHSA-r95x-qfjj-fjj2) dependency_analyzer · 95%
medium Vulnerable dependency: authlib@1.7.0 (GHSA-w8p2-r796-3vmq) dependency_analyzer · 95%
medium Vulnerable dependency: pydantic@2.0.0 (GHSA-mr82-8j83-vxmv) dependency_analyzer · 95%
medium Vulnerable dependency: pydantic@2.0.0 (PYSEC-2026-1812) dependency_analyzer · 95%
medium Hex string literal (>50 chars) in Arize-ai-phoenix-49cf5a7/src/phoenix/server/sandbox/_download.py:29 entropy_analyzer · 70%
medium Buffer.from base64 in Arize-ai-phoenix-49cf5a7/scripts/docker/devops/oidc-server/src/oidc/server.ts:744 entropy_analyzer · 75%
medium Buffer.from base64 in Arize-ai-phoenix-49cf5a7/scripts/docker/devops/oidc-server/src/oidc/server.ts:1637 entropy_analyzer · 75%
medium Hex string literal (>50 chars) in Arize-ai-phoenix-49cf5a7/js/app/tests/dataset-examples-overflow.spec.ts:11 entropy_analyzer · 70%
medium Buffer.from base64 in Arize-ai-phoenix-49cf5a7/js/packages/phoenix-mcp/src/identifiers.ts:17 entropy_analyzer · 75%
medium High-entropy string (5.95 bits/char) in Arize-ai-phoenix-49cf5a7/tests/integration/_mock_llm_server.py:311 entropy_analyzer · 54%
medium High-entropy string (5.95 bits/char) in Arize-ai-phoenix-49cf5a7/tests/integration/_mock_llm_server.py:317 entropy_analyzer · 54%
medium High-entropy string (6.04 bits/char) in Arize-ai-phoenix-49cf5a7/tests/unit/server/test_oauth2_authorization_server.py:29 entropy_analyzer · 55%
medium High-entropy string (6.04 bits/char) in Arize-ai-phoenix-49cf5a7/tests/unit/server/test_oauth2_authorization_server.py:42 entropy_analyzer · 55%
info package.json metadata manifest_parser · 100%
info pyproject.toml metadata manifest_parser · 100%
info Tool: analyze_stock manifest_parser · 90%
info Tool: optimize_portfolio manifest_parser · 90%
info Tool: forecast_market_trends manifest_parser · 90%
info Tool: analyze_economic_indicator manifest_parser · 90%
info Tool: generate_investment_report manifest_parser · 90%
info Tool: list_tool_groups manifest_parser · 90%
info Tool: enable_tool_group manifest_parser · 90%
info Tool: describeSqlSchema manifest_parser · 90%
high Permission: shell access detected permission_analyzer · 95%
medium Permission: database access detected permission_analyzer · 90%
info Tool: executeSql manifest_parser · 90%
info Tool: whoami manifest_parser · 90%
info Tool: f manifest_parser · 90%
info Tool: x manifest_parser · 90%
info Tool: anything manifest_parser · 90%
info Transport: streamable-http manifest_parser · 80%
info Required env vars (172) manifest_parser · 80%
medium Hardcoded OAuth client ID in Arize-ai-phoenix-49cf5a7/tests/unit/server/api/routers/test_oauth2.py oauth_scope_analyzer · 80%
high Deprecated implicit grant flow in Arize-ai-phoenix-49cf5a7/tests/integration/auth/test_oauth2.py oauth_scope_analyzer · 85%
medium Hardcoded OAuth client ID in Arize-ai-phoenix-49cf5a7/js/app/tests/oauth2-consent.spec.ts oauth_scope_analyzer · 80%
info Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium Permission: network access detected permission_analyzer · 90%
low Permission: filesystem access detected permission_analyzer · 90%
critical Database URL with Password found in Arize-ai-phoenix-49cf5a7/docker-compose.yml secret_scanner · 85%
critical Database URL with Password found in Arize-ai-phoenix-49cf5a7/helm/README.md secret_scanner · 85%
critical Database URL with Password found in Arize-ai-phoenix-49cf5a7/helm/values.yaml secret_scanner · 85%
high Hardcoded Password found in Arize-ai-phoenix-49cf5a7/helm/values.yaml secret_scanner · 65%
critical Database URL with Password found in Arize-ai-phoenix-49cf5a7/helm/templates/_helpers.tpl secret_scanner · 85%
critical AWS Access Key ID found in Arize-ai-phoenix-49cf5a7/tutorials/tracing/autogen_tutorial.ipynb secret_scanner · 95%
critical Database URL with Password found in Arize-ai-phoenix-49cf5a7/docs/phoenix/self-hosting/configuration.mdx secret_scanner · 85%
high Generic API Key Assignment found in Arize-ai-phoenix-49cf5a7/docs/phoenix/sdk-api-reference/openinference-sdk/openinference-java.mdx secret_scanner · 75%
high Generic API Key Assignment found in Arize-ai-phoenix-49cf5a7/docs/phoenix/integrations/llm-providers/openrouter/openai-tracing.mdx secret_scanner · 75%
high Generic API Key Assignment found in Arize-ai-phoenix-49cf5a7/docs/phoenix/integrations/llm-providers/orcarouter/openai-tracing.mdx secret_scanner · 75%
high Generic API Key Assignment found in Arize-ai-phoenix-49cf5a7/docs/phoenix/integrations/python/portkey/portkey-tracing.mdx secret_scanner · 75%
high Generic API Key Assignment found in Arize-ai-phoenix-49cf5a7/docs/phoenix/integrations/platforms/langflow/langflow-tracing.mdx secret_scanner · 75%
high Generic API Key Assignment found in Arize-ai-phoenix-49cf5a7/docs/phoenix/evaluation/how-to-evals/configuring-the-llm.mdx secret_scanner · 75%
high Hardcoded Password found in Arize-ai-phoenix-49cf5a7/docs/phoenix/self-hosting/features/email.mdx secret_scanner · 65%
high Hardcoded Password found in Arize-ai-phoenix-49cf5a7/docs/phoenix/self-hosting/features/authentication.mdx secret_scanner · 65%
critical Database URL with Password found in Arize-ai-phoenix-49cf5a7/docs/phoenix/self-hosting/deployment-options/docker.mdx secret_scanner · 85%
critical Database URL with Password found in Arize-ai-phoenix-49cf5a7/docs/phoenix/self-hosting/advanced/encryption.mdx secret_scanner · 85%
critical Database URL with Password found in Arize-ai-phoenix-49cf5a7/kustomize/base/phoenix.yaml secret_scanner · 85%
high Generic API Key Assignment found in Arize-ai-phoenix-49cf5a7/src/phoenix/config.py secret_scanner · 75%
critical Database URL with Password found in Arize-ai-phoenix-49cf5a7/src/phoenix/config.py secret_scanner · 85%
high Hardcoded Password found in Arize-ai-phoenix-49cf5a7/src/phoenix/config.py secret_scanner · 65%
critical Database URL with Password found in Arize-ai-phoenix-49cf5a7/scripts/docker/devops/docker-compose.yml secret_scanner · 85%
high Hardcoded Password found in Arize-ai-phoenix-49cf5a7/scripts/docker/devops/ldap-grafana.toml secret_scanner · 65%
critical Database URL with Password found in Arize-ai-phoenix-49cf5a7/scripts/docker/devops/overrides/toxiproxy.yml secret_scanner · 85%
critical Database URL with Password found in Arize-ai-phoenix-49cf5a7/scripts/docker/devops/k8s/phoenix-oidc-sidecar-patch.yml secret_scanner · 85%
high Authorization Bearer Token found in Arize-ai-phoenix-49cf5a7/js/benchmarks/evals-benchmarks/src/tool_response_handling.eval.ts secret_scanner · 70%
critical Database URL with Password found in Arize-ai-phoenix-49cf5a7/js/benchmarks/evals-benchmarks/src/tool_response_handling.eval.ts secret_scanner · 85%
high Generic API Key Assignment found in Arize-ai-phoenix-49cf5a7/js/app/scripts/setup-remote-export.ts secret_scanner · 75%
high Hardcoded Password found in Arize-ai-phoenix-49cf5a7/js/app/src/pages/settings/UserActionMenu.tsx secret_scanner · 65%
high Generic API Key Assignment found in Arize-ai-phoenix-49cf5a7/js/packages/phoenix-otel/src/register.ts secret_scanner · 75%
high Hardcoded Password found in Arize-ai-phoenix-49cf5a7/internal_docs/vignettes/sqlalchemy/polymorphic_user/users.py secret_scanner · 65%
medium No build provenance detected (SLSA L0) slsa_assessor · 90%