safishamsi/graphify

Scanned on Jun 17, 2026

Risk score/ 100

High risk

Summary

The repository contains 6 critical cryptographic vulnerabilities using broken algorithms (SHA-1, MD5). Most concerning are MD5-based HTTP Digest Authentication implementations that could allow credential theft and session hijacking. While some SHA-1 usage appears non-security-critical (hashing for deduplication), the MD5 authentication mechanism poses immediate risk to application security.

Critical

High

Medium

Low

Top findings

CriticalSHA-1

graphify/_minhash.py:47

SHA-256 or SHA3-256

Raw evidence

hv = np.uint64(struct.unpack("<I", hashlib.sha1(v).digest()[:4])[0])

CriticalSHA-1

graphify/transcribe.py:61

SHA-256 or SHA3-256

Raw evidence

url_hash = hashlib.sha1(url.encode(), usedforsecurity=False).hexdigest()[:12]

CriticalMD5
worked/httpx/raw/auth.py:85
SHA3-256 or SHA-256
Raw evidence
```
cnonce = hashlib.md5(str(time.time()).encode()).hexdigest()[:8]
```

CriticalMD5

worked/httpx/raw/auth.py:89

SHA3-256 or SHA-256

Raw evidence

ha1 = hashlib.md5(f"{self.username}:{realm}:{self.password}".encode()).hexdigest()

CriticalMD5

worked/httpx/raw/auth.py:90

SHA3-256 or SHA-256

Raw evidence

ha2 = hashlib.md5(f"{request.method}:{request.url.path}".encode()).hexdigest()

+ 1 more finding in the full report

Scan your own repository

Free. Results in ~90 seconds. CBOM + DORA/NIS2 PDF included.

Start a free scan