[Security] Automated static analysis findings for jaredthecoder/BioPy (academic research) #5

Hello maintainers,

We are reaching out as part of an academic study on software security in the open-source Artificial Intelligence (AI) supply chain. As part of this study, we ran automated static analysis on jaredthecoder/BioPy and would like to share the aggregated results with you, so that the project can verify them and act if needed.

Context of the research

This analysis is part of the doctoral thesis "Reducing Software Vulnerabilities in the Artificial Intelligence Supply Chain", developed under a joint supervision (cotutelle) between:

• Universidade de São Paulo (USP): Programa de Pós-Graduação em Sistemas de Informação (PPgSI), Escola de Artes, Ciências e Humanidades (EACH), Brazil;
• Nantes Université: LS2N (UMR CNRS 6004), NaoMod team, France.

Researchers:

• Felipe Cordeiro Alves Dias, PhD candidate (USP / Nantes Université);
• Prof. Dr. Daniel de Angelis Cordeiro, advisor (EACH-USP);
• Prof. Dr. Gerson Sunyé, co-advisor (Nantes Université, LS2N / NaoMod).

The methodology and the first results of this study were published at the XXII Brazilian Symposium on Information Systems (SBSI 2026):
https://sol.sbc.org.br/index.php/sbsi/article/view/41368

What we did

On 2026-08-16, a fork of this repository, synchronized with the upstream default branch, was analyzed with GitHub CodeQL (source code), GitHub Dependabot (declared dependencies) and Semgrep Supply Chain (dependencies, including a reachability verdict). The scope is limited to Python: only CodeQL's Python analysis, Python (pip/PyPI) dependencies, and files present in the upstream repository are reported; code in other languages (e.g., C/C++) was not assessed. The only exception is possibly exposed credentials, which are reported regardless of language. No code was executed against any deployment of the project, and no exploitation was attempted.

Aggregated findings

Evidence

• Snapshot of the analysis data: 2026-08-16
• Analyzed commit(s) of the upstream code: 8b2eb42ff4cc
• Each identifier below links to its public reference (NVD/GitHub Advisory Database, MITRE CWE, MITRE CAPEC, MITRE ATT&CK, OWASP).
• CAPEC and ATT&CK entries are derived from the CWEs found, through MITRE's own mappings (CAPEC Related_Weaknesses and Taxonomy_Mappings); they describe how such weaknesses are typically exploited, not attacks observed against this project.

Findings by security standard

Automated tools produce false positives, and a vulnerable dependency is not necessarily exploitable in this project's context (see the reachability column). These numbers should be read as candidates for verification, not as confirmed vulnerabilities.

Recommendations

1. Verify the findings above; we can share the detailed list privately on request.
2. Check the latest security reports and advisories relevant to the project's dependencies, such as the GitHub Advisory Database, the NVD, OSV.dev and the OWASP Top 10 for LLM Applications.
3. If not yet enabled, consider enabling Dependabot alerts, code scanning, secret scanning and Private Vulnerability Reporting in the repository settings.

Ethical principles

• Defensive purpose only. The goal is to help improve the security of the AI ecosystem; the fork was used exclusively for static analysis.
• No exploitation. No finding was tested against running systems, and no attempt was made to validate credentials or access third-party services.
• Responsible disclosure. Sensitive details (file paths, line numbers, exploit conditions, and anything related to credentials) are never posted publicly. This report is sent through the repository itself: privately, through GitHub Private Vulnerability Reporting, whenever the project has it enabled, and as a public issue only otherwise.
• Aggregated publication. Research outputs report results only in aggregated or anonymized form, and never disclose secret values.
• Voluntary participation. Maintainers are under no obligation to reply. If you prefer not to receive further contact about this study, just say so in this thread and we will not contact you again.

Thank you for maintaining this project. If you have questions about this analysis, you can reply here or contact us at felipecavazotto@usp.br.

Felipe Cordeiro Alves Dias, on behalf of the research team