psf/requests
A simple, yet elegant, HTTP library.
- Repository: https://github.com/psf/requests
- Commit:
3c7baaa05ab4aa49cc819ce3a819d260de19c157 - Generated: 2026-11-09T19:28:54+00:00
- Scorer 0.1.0, scoring prov-2+qual-1+sec-1, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | possible | 65% | 100% |
| Code quality | 85 | strong | 90% | 100% |
| Security | 90 | strong | 85% | 100% |
AI provenance
Weak signals consistent with AI-assisted development. 1 commit(s) carry explicit AI attribution, too few to characterize the codebase.
- Explicitly attributed share (lower bound): 0.0%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 0.0%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 1 | 2 |
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2024-10 | 1 | 0% |
| 2025-02 | 5 | 0% |
| 2025-05 | 28 | 0% |
| 2025-06 | 69 | 0% |
| 2025-07 | 4 | 0% |
| 2025-08 | 2 | 0% |
| 2026-01 | 47 | 0% |
| 2026-02 | 18 | 0% |
| 2026-03 | 39 | 5% |
| 2026-04 | 46 | 0% |
| 2026-05 | 1,369 | 0% |
| 2026-06 | 86 | 0% |
Evidence
- Claude Code: trailer 'Co-Authored-By: Claude' (b2a1d33f5715)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is strong: test-to-source ratio 0.75, CI runs tests; 16% of function code in complex or long functions; 2% duplicated lines. Weakest area: type safety.
| Area | Score |
|---|---|
| Complexity (lizard) | 62 |
| Duplication | 86 |
| Code smells (Opengrep) | 80 |
| Tests and CI | 99 |
| Documentation | 100 |
| Type safety | 60 |
| Process (Scorecard review/maintenance) | 100 |
- Functions: 245; mean complexity 3.4, 90th percentile 7; 8 complex and 0 long functions
- Duplicated lines: 2.4% of 4,962 compared
- Tests: 5,158 test lines for 6,874 source lines (ratio 0.75); CI test commands: make ci; 22% of recent source commits also change tests
- Docs missing or thin: none
Most complex functions:
- _encode_files in src/requests/models.py: complexity 21, 51 lines
- send in src/requests/adapters.py: complexity 19, 81 lines
- build_digest_header in src/requests/auth.py: complexity 19, 68 lines
- prepare_body in src/requests/models.py: complexity 19, 48 lines
- should_bypass_proxies in src/requests/utils.py: complexity 19, 37 lines
Security
Security posture is strong: no high-impact findings. Weakest area: secrets.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 74 |
| Static analysis (Opengrep) | 93 |
| Vulnerable dependencies (OSV) | 100 |
| CI workflows (zizmor) | 100 |
| Posture (policy, updates, signing, lockfiles) | 100 |
| OpenSSF Scorecard | 79 |
- Posture checks passed: security policy, dependency updates, signed commits, lockfiles; missing: none
- OpenSSF Scorecard aggregate: 8.4/10 (published 2026-10-26)
Top findings
| Severity | Finding | Location |
|---|---|---|
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] |
src/requests/auth.py:187 |
| medium | opengrep/python.lang.security.insecure-hash-algorithm-sha1: Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium] |
src/requests/auth.py:237 |
| medium | opengrep/python.lang.security.audit.non-literal-import: Untrusted user input in importlib.import_module() function allows an attacker to load arbitrary code. Avoid dynamic values in importlib.import_module() or use a whitelist to prevent running untrusted code. [confidence low] |
src/requests/compat.py:42 |
| low | gitleaks/private-key: Possible private-key secret in the current tree (test/docs/example file) |
tests/certs/expired/ca/ca-private.key:1 |
| low | gitleaks/private-key: Possible private-key secret in the current tree (test/docs/example file) |
tests/certs/mtls/client/client.key:1 |
| low | gitleaks/private-key: Possible private-key secret in the current tree (test/docs/example file) |
tests/certs/expired/server/server.key:1 |
| low | gitleaks/private-key: Possible private-key secret in the current tree (test/docs/example file) |
tests/certs/valid/server/server.key:1 |
| low | gitleaks/generic-api-key: Possible generic-api-key secret in history (commit 74289f420c); removed from the current tree but still retrievable |
docs/_templates/sidebarintro.html:27 |
| low | gitleaks/generic-api-key: Possible generic-api-key secret in history (commit 749419ad0c); removed from the current tree but still retrievable |
docs/_templates/sidebarlogo.html:26 |
| low | gitleaks/generic-api-key: Possible generic-api-key secret in history (commit 9576518d69); removed from the current tree but still retrievable |
requests/packages/oauthlib/oauth1/rfc5849/parameters.py:32 |
| low | gitleaks/generic-api-key: Possible generic-api-key secret in history (commit 9576518d69); removed from the current tree but still retrievable |
requests/packages/oauthlib/oauth2/draft25/parameters.py:168 |
| low | gitleaks/generic-api-key: Possible generic-api-key secret in history (commit 9576518d69); removed from the current tree but still retrievable |
requests/packages/oauthlib/oauth1/rfc5849/signature.py:49 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 6,874; test lines: 5,158
| Language | Lines |
|---|---|
| Python | 12,032 |