DataPipeline ML Service

Python

High

56

Security Factor Score

Exposed

6

Critical Findings

6

High Findings

20

Total Findings

7-Pillar Breakdown

Code

20% weight

Supply Chain

15% weight

Runtime/API

15% weight

Infra/Config

15% weight

Compliance

15% weight

Proactive

10% weight

Observability

10% weight

Application Details

Name	DataPipeline ML Service
Technology	Python
Repository	https://github.com/contoso/ml-pipeline
Source Path	/src/ml_pipeline
Branch	main
Type	Americas
Business Unit	Data Science
Owner	Sarah Miller
Contact	sarah.miller@contoso.com
Created	Mar 01, 2026
Last Scan	Jun 01, 2026 18:02

Recent Findings

Critical

User input directly concatenated to LLM prompt

AISecurity — Prompt Injection

Open

Critical

pickle.load() used on untrusted model file

AISecurity — Insecure Model Loading

Open

Critical

AWS Access Key exposed in configuration file

Secrets — Hardcoded Secret

Open

Critical

Reflected XSS in error message display

SAST — Cross-Site Scripting

Open

Critical

SQL Injection in user search query

SAST — SQL Injection

Open

Critical

CVE-2024-3094: Critical backdoor in xz-utils 5.6.0

SCA — Vulnerable Dependency

Open

High

Vector store accepts unsanitized document content

AISecurity — RAG Poisoning

Open

High

Stripe API key found in JavaScript bundle

Secrets — Exposed API Key

Open

Dependencies (8)

Package	Version	Vulns
cryptography	`41.0.0`	3
flask	`2.3.2`
langchain	`0.1.0`	2
numpy	`1.24.0`
openai	`1.12.0`
pillow	`9.5.0`	2
requests	`2.31.0`
torch	`2.1.0`	1

Secret Exposures (5)

AWS Access Key

src/config/aws-config.json:8 — AKIA3...HN2Q

API Key (Stripe)

src/Services/PaymentService.cs:15 — sk_live_51...gKlP

Private Key

.ssh/id_rsa:1 — -----BEGIN RSA PRI...

Database Password

src/appsettings.Production.json:5 — Password=Pr0d...x!

JWT Secret

src/config/auth.json:3 — super-se...key123

Scan History

Type	Status	Findings	Critical	High	Duration	Date	Initiated By
Secrets	Completed	0	0	0	81.0s	Jun 01, 10:02	User
SAST	Completed	7	2	2	15.0s	Jun 01, 06:02	User
SCA	Completed	0	0	0	133.0s	May 31, 14:02	User
Config	Completed	0	0	0	70.0s	May 31, 04:02	User
Full Scan	Completed	20	6	6	170.0s	May 30, 08:02	Schedule
IaC	Completed	0	0	0	174.0s	May 30, 03:02	User