Security Scan Results

ASH Security Scan Report

• Report generated: 2026-11-11T01:20:16+00:00
• Time since scan: 2 minutes

Scan Metadata

• Project: ASH
• Scan executed: 2026-11-11T01:17:43+00:00
• ASH version: 3.1.2

Summary

Scanner Results

The table below shows findings by scanner, with status based on severity thresholds and dependencies:

• Severity levels:
  • Suppressed (S): Findings that have been explicitly suppressed and don't affect scanner status
  • Critical (C): Highest severity findings that require immediate attention
  • High (H): Serious findings that should be addressed soon
  • Medium (M): Moderate risk findings
  • Low (L): Lower risk findings
  • Info (I): Informational findings with minimal risk
• Duration (Time): Time taken by the scanner to complete its execution
• Actionable: Number of findings at or above the threshold severity level that require attention
• Result:
  • PASSED = No findings at or above threshold
  • FAILED = Findings at or above threshold
  • MISSING = Required dependencies not available
  • SKIPPED = Scanner explicitly disabled
  • ERROR = Scanner execution error
• Threshold: The minimum severity level that will cause a scanner to fail
  • Thresholds: ALL, LOW, MEDIUM, HIGH, CRITICAL
  • Source: Values in parentheses indicate where the threshold is set:
    • global (global_settings section in the ASH_CONFIG used)
    • config (scanner config section in the ASH_CONFIG used)
    • scanner (default configuration in the plugin, if explicitly set)
• Statistics calculation:
  • All statistics are calculated from the final aggregated SARIF report
  • Suppressed findings are counted separately and do not contribute to actionable findings
  • Scanner status is determined by comparing actionable findings to the threshold

Top 4 Hotspots

Files with the highest number of security findings:

Detailed Findings

Secret of type Hex High Entropy String detected

)
with urllib.request.urlopen(url, timeout=60) as resp:
    rows = [item["row"] for item in json.load(resp)["rows"]]

uuid.UUID(int=1),
            pathlib.Path("/tmp/x"),
            b"bytes",

def published_label(node: dict, section: str, object_lists: set) -> str:
            counts_objects = eval(  # noqa: S307
                cond.group(1),
                {},
                {"data": node, "section": section, "OBJECT_LISTS": object_lists},
            )
            return eval(unit.group(1), {}, {"counts_objects": counts_objects})  # noqa: S307

)
            return eval(unit.group(1), {}, {"counts_objects": counts_objects})  # noqa: S307

with contextlib.redirect_stdout(out):
        exec(code, namespace)
    prints = [line for line in code.splitlines() if line.startswith("print(")]

)
with urllib.request.urlopen(url, timeout=60) as resp:
    rows = [item["row"] for item in json.load(resp)["rows"]]

Report generated by Automated Security Helper (ASH) at 2026-11-11T01:20:17+00:00

I'm taking this review. I checked the core of it on this head: the six new tests fail on current dev and pass here, so the cards now get their threshold colour and a results dict's document_count reaches both the card and the bulk title. CI passes.

One thing for you now: since #455 merged, this conflicts with dev in CHANGELOG.md only. Both PRs add a bullet under [Unreleased] / ### Fixed, so keeping both bullets under that one heading resolves it. This branch predates the 1.0.1 release, so check the entry lands under the current [Unreleased] and not inside [1.0.1]. I'll post the full review this week.

Thanks @digalaviz! Merged dev and resolved the conflict in CHANGELOG.md with both entries preserved under [Unreleased] / ### Fixed. Clean merge and all test suites passing.