psf/requests-html

Pythonic HTML Parsing for Humans™

https://github.com/psf/requests-html · commit 075ac162dc62 · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/psf/requests-html
Commit: 075ac162dc62fc532037df0d98954ab840a97516
Generated: 2026-11-13T23:20:05+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	none-detected	65%	100%
Code quality	74	adequate	90%	100%
Security	53	weak	85%	100%

AI provenance

No AI attribution or AI-consistent velocity signals detected.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%

Month	Lines added	Attributed to AI
2018-08	4	0%
2018-09	10	0%
2019-01	3	0%
2019-02	12	0%
2019-04	83	0%
2019-05	1	0%
2019-07	2	0%
2020-02	2	0%
2020-05	3	0%
2021-10	5	0%
2022-07	2	0%
2023-02	43	0%

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.32, no CI test run detected; 0% of function code in complex or long functions; 6% duplicated lines. Weakest area: process.

Area	Score
Complexity (lizard)	100
Duplication	70
Code smells (Opengrep)	100
Tests and CI	66
Documentation	65
Type safety	40
Process (Scorecard review/maintenance)	35

Functions: 59; mean complexity 2.8, 90th percentile 7; 0 complex and 0 long functions
Duplicated lines: 5.8% of 822 compared
Tests: 371 test lines for 1,164 source lines (ratio 0.32); CI test commands: none detected; 12% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Security

Security posture is weak: 53 known vulnerabilities in 13 dependencies; 2 high-severity SAST findings. Weakest area: posture.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	59
Vulnerable dependencies (OSV)	27
CI workflows (zizmor)	n/a
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	25

Known vulnerabilities: 53 in 13 packages (critical 1, high 23, medium 22, low 3)
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
OpenSSF Scorecard aggregate: 3.0/10 (published 2026-10-26)

Top findings

Severity	Finding	Location
critical	`osv/GHSA-6q48-6c7w-9gw2`: certifi@2022.12.7 (PyPI) is affected by PYSEC-2026-4320, GHSA-6q48-6c7w-9gw2	Pipfile.lock
high	`opengrep/python.lang.security.audit.dangerous-system-call-audit`: Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]	setup.py:64
high	`opengrep/python.lang.security.audit.dangerous-system-call-audit`: Found dynamic content used in a system call. This is dangerous if external data can reach this function call because it allows a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability. [confidence low]	setup.py:70
high	`osv/GHSA-xqr8-7jwr-rhp7`: certifi@2022.12.7 (PyPI) is affected by PYSEC-2023-135, GHSA-xqr8-7jwr-rhp7	Pipfile.lock
high	`osv/GHSA-248v-346w-9cwc`: certifi@2022.12.7 (PyPI) is affected by PYSEC-2024-230, GHSA-248v-346w-9cwc	Pipfile.lock
high	`osv/GHSA-jfhm-5ghh-2f97`: cryptography@39.0.1 (PyPI) is affected by PYSEC-2023-254, GHSA-jfhm-5ghh-2f97	Pipfile.lock
high	`osv/GHSA-6vqw-3v5j-54x4`: cryptography@39.0.1 (PyPI) is affected by PYSEC-2024-225, GHSA-6vqw-3v5j-54x4	Pipfile.lock
high	`osv/GHSA-3ww4-gg4f-jr7f`: cryptography@39.0.1 (PyPI) is affected by PYSEC-2026-1283, GHSA-3ww4-gg4f-jr7f	Pipfile.lock
high	`osv/GHSA-r6ph-v2qm-q3c2`: cryptography@39.0.1 (PyPI) is affected by PYSEC-2026-2141, GHSA-r6ph-v2qm-q3c2	Pipfile.lock
high	`osv/PYSEC-2026-3553`: cryptography@39.0.1 (PyPI) is affected by PYSEC-2026-3553	Pipfile.lock
high	`osv/GHSA-537c-gmf6-5ccf`: cryptography@39.0.1 (PyPI) is affected by GHSA-537c-gmf6-5ccf	Pipfile.lock
high	`osv/GHSA-jjg7-2v4v-x38h`: idna@3.4 (PyPI) is affected by PYSEC-2024-60, GHSA-jjg7-2v4v-x38h	Pipfile.lock
high	`osv/GHSA-gmj6-6f8f-6699`: jinja2@3.1.2 (PyPI) is affected by PYSEC-2026-1472, GHSA-gmj6-6f8f-6699	Pipfile.lock
high	`osv/GHSA-q2x7-8rv6-6q7h`: jinja2@3.1.2 (PyPI) is affected by PYSEC-2026-1475, GHSA-q2x7-8rv6-6q7h	Pipfile.lock
high	`osv/GHSA-vfmq-68hx-4jfw`: lxml@4.9.2 (PyPI) is affected by PYSEC-2026-87, GHSA-vfmq-68hx-4jfw	Pipfile.lock
high	`osv/GHSA-2wc2-fm75-p42x`: soupsieve@2.4 (PyPI) is affected by PYSEC-2026-3071, GHSA-2wc2-fm75-p42x	Pipfile.lock
high	`osv/GHSA-836r-79rf-4m37`: soupsieve@2.4 (PyPI) is affected by PYSEC-2026-3072, GHSA-836r-79rf-4m37	Pipfile.lock
high	`osv/GHSA-6655-6qjp-jx7x`: soupsieve@2.4 (PyPI) is affected by GHSA-6655-6qjp-jx7x	Pipfile.lock
high	`osv/GHSA-mmhr-3c5m-f64f`: soupsieve@2.4 (PyPI) is affected by GHSA-mmhr-3c5m-f64f	Pipfile.lock
high	`osv/GHSA-v845-jxx5-vc9f`: urllib3@1.26.14 (PyPI) is affected by PYSEC-2023-192, GHSA-v845-jxx5-vc9f	Pipfile.lock
high	`osv/GHSA-qccp-gfcp-xxvc`: urllib3@1.26.14 (PyPI) is affected by PYSEC-2026-141, GHSA-qccp-gfcp-xxvc	Pipfile.lock
high	`osv/GHSA-2xpw-w6gg-jr37`: urllib3@1.26.14 (PyPI) is affected by PYSEC-2026-1994, GHSA-2xpw-w6gg-jr37	Pipfile.lock
high	`osv/GHSA-38jv-5279-wg99`: urllib3@1.26.14 (PyPI) is affected by PYSEC-2026-1996, GHSA-38jv-5279-wg99	Pipfile.lock
high	`osv/GHSA-gm62-xv2j-4w53`: urllib3@1.26.14 (PyPI) is affected by PYSEC-2026-1998, GHSA-gm62-xv2j-4w53	Pipfile.lock
high	`osv/GHSA-8988-9cw3-xx77`: urllib3@1.26.14 (PyPI) is affected by PYSEC-2026-4175, GHSA-8988-9cw3-xx77	Pipfile.lock

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 1,164; test lines: 371

Language	Lines
Python	1,535

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/psf/requests-html/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/psf/requests-html/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/psf/requests-html/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/psf/requests-html/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/psf/requests-html/security.svg)](https://repotrust.synapticcyber.com/r/github.com/psf/requests-html/)