🛡️ Security Scan Report

{
  "SchemaVersion": 2,
  "Trivy": {
    "Version": "0.69.0"
  },
  "ReportID": "019c935c-452f-741b-bd45-c990d3625d12",
  "CreatedAt": "2026-02-25T05:53:43.727270332Z",
  "ArtifactID": "sha256:b0afba309f578af8868fab89e34bf37fcff4fd14c7d7fff0f6d5a9654f4da939",
  "ArtifactName": "/src",
  "ArtifactType": "repository",
  "Metadata": {
    "RepoURL": "https://github.com/eizen-ai/eizen-email-service",
    "Branch": "vulnerability-fix",
    "Commit": "f1fe659240fea63fe4829219cd1756340434e899",
    "CommitMsg": "fix: move tests to root, mock eizen_utils for CI, fix SonarQube issues",
    "Author": "eizen-anurag <anurag.bheemani@eizen.ai>",
    "Committer": "eizen-anurag <anurag.bheemani@eizen.ai>"
  },
  "Results": [
    {
      "Target": "requirements.txt",
      "Class": "lang-pkgs",
      "Type": "pip",
      "Packages": [
        {
          "Name": "email_validator",
          "Identifier": {
            "PURL": "pkg:pypi/email-validator@2.2.0",
            "UID": "bf05522b84e97cd3"
          },
          "Version": "2.2.0",
          "Locations": [
            {
              "StartLine": 2,
              "EndLine": 2
            }
          ],
          "AnalyzedBy": "pip"
        },
        {
          "Name": "fastapi",
          "Identifier": {
            "PURL": "pkg:pypi/fastapi@0.115.12",
            "UID": "fae61dc75ad679ee"
          },
          "Version": "0.115.12",
          "Locations": [
            {
              "StartLine": 1,
              "EndLine": 1
            }
          ],
          "AnalyzedBy": "pip"
        },
        {
          "Name": "httpx",
          "Identifier": {
            "PURL": "pkg:pypi/httpx@0.28.1",
            "UID": "5f110d35b19d795b"
          },
          "Version": "0.28.1",
          "Locations": [
            {
              "StartLine": 7,
              "EndLine": 7
            }
          ],
          "AnalyzedBy": "pip"
        },
        {
          "Name": "loguru",
          "Identifier": {
            "PURL": "pkg:pypi/loguru@0.7.3",
            "UID": "fec8504f881e2070"
          },
          "Version": "0.7.3",
          "Locations": [
            {
              "StartLine": 3,
              "EndLine": 3
            }
          ],
          "AnalyzedBy": "pip"
        },
        {
          "Name": "pytest",
          "Identifier": {
            "PURL": "pkg:pypi/pytest@8.3.5",
            "UID": "9e2e1a1854596320"
          },
          "Version": "8.3.5",
          "Locations": [
            {
              "StartLine": 8,
              "EndLine": 8
            }
          ],
          "AnalyzedBy": "pip"
        },
        {
          "Name": "pytest-asyncio",
          "Identifier": {
            "PURL": "pkg:pypi/pytest-asyncio@0.25.3",
            "UID": "7c26ed92db9913e7"
          },
          "Version": "0.25.3",
          "Locations": [
            {
              "StartLine": 10,
              "EndLine": 10
            }
          ],
          "AnalyzedBy": "pip"
        },
        {
          "Name": "pytest-cov",
          "Identifier": {
            "PURL": "pkg:pypi/pytest-cov@6.1.1",
            "UID": "73afff4185e603c7"
          },
          "Version": "6.1.1",
          "Locations": [
            {
              "StartLine": 9,
              "EndLine": 9
            }
          ],
          "AnalyzedBy": "pip"
        },
        {
          "Name": "python-dotenv",
          "Identifier": {
            "PURL": "pkg:pypi/python-dotenv@1.1.0",
            "UID": "ddce0c4aad4fc675"
          },
          "Version": "1.1.0",
          "Locations": [
            {
              "StartLine": 4,
              "EndLine": 4
            }
          ],
          "AnalyzedBy": "pip"
        },
        {
          "Name": "requests",
          "Identifier": {
            "PURL": "pkg:pypi/requests@2.32.4",
            "UID": "5c57eb6154ef1960"
          },
          "Version": "2.32.4",
          "Locations": [
            {
              "StartLine": 5,
              "EndLine": 5
            }
          ],
          "AnalyzedBy": "pip"
        },
        {
          "Name": "uvicorn",
          "Identifier": {
            "PURL": "pkg:pypi/uvicorn@0.34.3",
            "UID": "6238265aecab3685"
          },
          "Version": "0.34.3",
          "Locations": [
            {
              "StartLine": 6,
              "EndLine": 6
            }
          ],
          "AnalyzedBy": "pip"
        }
      ]
    },
    {
      "Target": "Dockerfile",
      "Class": "config",
      "Type": "dockerfile",
      "MisconfSummary": {
        "Successes": 23,
        "Failures": 1
      },
      "Misconfigurations": [
        {
          "Type": "Dockerfile Security Check",
          "ID": "DS-0002",
          "Title": "Image user should not be 'root'",
          "Description": "Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.",
          "Message": "Specify at least 1 USER command in Dockerfile with non-root user as argument",
          "Namespace": "builtin.dockerfile.DS002",
          "Query": "data.builtin.dockerfile.DS002.deny",
          "Resolution": "Add 'USER <non root user name>' line to the Dockerfile",
          "Severity": "HIGH",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ds-0002",
          "References": [
            "https://docs.docker.com/develop/develop-images/dockerfile_best-practices/",
            "https://avd.aquasec.com/misconfig/ds-0002"
          ],
          "Status": "FAIL",
          "CauseMetadata": {
            "Provider": "Dockerfile",
            "Service": "general"
          }
        }
      ]
    }
  ]
}