T08 · Insecure Dependencies
Error
- Location
pyproject.toml:10- Finding
Unpinned and Unverifiable SDK Dependency Handles Financial Credentials and Real-Money Operations
- Content
View full analysis
=1.2" ] ``` `docs/getting-started/installation.md:12-23` directs users to install mutable packages from PyPI without an exact version or hash: ```markdown ## Standard Install (PyPI) ```bash pip install peerberry-sdk ``` Use this for normal application usage when you do not need optional two-factor helpers. ## Install With OTP Support ```bash pip install "peerberry-sdk[otp]" ``` ``` `docs/gen_client_reference.py:15-41` expects a local `src` directory but imports `peerberry_sdk` even when that source tree is unavailable: ```python PROJECT_ROOT = Path(__file__).resolve().parents[1] SOURCE_ROOT = PROJECT_ROOT / 'src' OUTPUT_PATH = 'api/client.md' if str(SOURCE_ROOT) not in sys.path: sys.path.insert(0, str(SOURCE_ROOT)) # Allow running this generator even when optional runtime deps are not installed. if 'cloudscraper' not in sys.modules: try: import cloudscraper # noqa: F401 except ModuleNotFoundError: class _NoopSession: headers = {} def request(self, *args, **kwargs): raise RuntimeError('Noop session cannot perform requests.') def get(self, *args, **kwargs): raise RuntimeError('Noop session cannot perform requests.') sys.modules['cloudscraper'] = types.SimpleNamespace( create_scraper=lambda browser: _NoopSession(), ) from peerberry_sdk.client import PeerberryClient from peerberry_sdk.config import AuthConfig, LifecycleConfi ...[truncated 3492 chars]- Remediation
View remediation