Search results

Release pipeline installs unpinned PyInstaller with contents:write — supply chain compromise risk in distributed binaries

Status: Open.

#30 In Doble-2/osint-d2;

· tg12 opened on Jun 8, 2026

Sherlock manifest downloaded from master branch without integrity verification — supply chain attack surface

Status: Open.

#29 In Doble-2/osint-d2;

· tg12 opened on Jun 8, 2026

Reddit scraper violates API Terms of Service — no OAuth, fake browser User-Agent

Status: Open.

#28 In Doble-2/osint-d2;

· tg12 opened on Jun 8, 2026

Unbounded recursive expansion loop in hunt() — no iteration cap, no target count limit

Status: Open.

#26 In Doble-2/osint-d2;

· tg12 opened on Jun 8, 2026

Agent fetch_url tool has no SSRF guard — internal network and IMDS endpoints reachable via prompt injection in target profile data

Status: Open.

#25 In Doble-2/osint-d2;

· tg12 opened on Jun 8, 2026

Breach check bypasses HIBP official API via TLS fingerprint spoofing and undocumented endpoint — ToS violation

Status: Open.

#24 In Doble-2/osint-d2;

· tg12 opened on Jun 8, 2026

TLS certificate verification silently disabled for all requests when proxy is configured

Status: Open.

#23 In Doble-2/osint-d2;

· tg12 opened on Jun 8, 2026