{"evidence":{"claim_boundary":["No known vulnerabilities were returned for the exact lock at scan time.","This scan does not prove absence of zero-day, application, configuration, image, OS or transitive binary issues outside the resolved package metadata.","Production acceptance still requires security review, license review and an approved OCI image digest."],"dependencies":[{"name":"blinker","version":"1.9.0","vulns":[]},{"name":"boto3","version":"1.43.83","vulns":[]},{"name":"botocore","version":"1.43.83","vulns":[]},{"name":"jmespath","version":"1.1.0","vulns":[]},{"name":"python-dateutil","version":"2.9.0.post0","vulns":[]},{"name":"s3transfer","version":"0.19.2","vulns":[]},{"name":"urllib3","version":"2.7.0","vulns":[]},{"name":"certifi","version":"2026.7.22","vulns":[]},{"name":"cffi","version":"2.1.1","vulns":[]},{"name":"charset-normalizer","version":"3.5.1","vulns":[]},{"name":"click","version":"8.5.0","vulns":[]},{"name":"colorama","version":"0.4.6","vulns":[]},{"name":"cryptography","version":"50.0.1","vulns":[]},{"name":"deprecated","version":"1.3.1","vulns":[]},{"name":"wrapt","version":"2.3.0","vulns":[]},{"name":"flask","version":"3.1.3","vulns":[]},{"name":"flask-limiter","version":"4.1.1","vulns":[]},{"name":"ordered-set","version":"4.1.0","vulns":[]},{"name":"flask-wtf","version":"1.3.0","vulns":[]},{"name":"gunicorn","version":"26.2.0","vulns":[]},{"name":"idna","version":"3.19","vulns":[]},{"name":"iniconfig","version":"2.3.0","vulns":[]},{"name":"itsdangerous","version":"2.2.0","vulns":[]},{"name":"jinja2","version":"3.1.6","vulns":[]},{"name":"limits","version":"5.8.0","vulns":[]},{"name":"markdown","version":"3.10.3","vulns":[]},{"name":"markupsafe","version":"3.0.3","vulns":[]},{"name":"pillow","version":"12.3.0","vulns":[]},{"name":"pluggy","version":"1.6.0","vulns":[]},{"name":"psycopg2-binary","version":"2.9.12","vulns":[]},{"name":"pycparser","version":"3.0","vulns":[]},{"name":"pygments","version":"2.21.0","vulns":[]},{"name":"pytest","version":"9.1.1","vulns":[]},{"name":"python-dotenv","version":"1.2.3","vulns":[]},{"name":"pyyaml","version":"6.0.3","vulns":[]},{"name":"requests","version":"2.34.2","vulns":[]},{"name":"sentry-sdk","version":"2.68.1","vulns":[]},{"name":"six","version":"1.17.0","vulns":[]},{"name":"stripe","version":"15.6.0","vulns":[]},{"name":"typing-extensions","version":"4.16.0","vulns":[]},{"name":"werkzeug","version":"3.1.8","vulns":[]},{"name":"wtforms","version":"3.2.2","vulns":[]}],"dependencies_scanned":42,"evidence_id":"RUNTIME_VULNERABILITY_AUDIT_20260829","generated_at_utc":"2026-08-29T07:32:30.974394+00:00","lock_sha256":"74352a806768af7a9a07c43aad6e77cf21e588bec79bc51a3373154f0bf898fa","scanner":"pip-audit 2.10.1","source":"Python Packaging Advisory Database and OSV where available through pip-audit","status":"PASS_NO_KNOWN_VULNERABILITIES","verification_state":"LOCK_BOUND_PIP_AUDIT","vulnerability_count":0},"limitations":["No known vulnerabilities were returned for the exact lock at scan time.","This scan does not prove absence of zero-day, application, configuration, image, OS or transitive binary issues outside the resolved package metadata.","Production acceptance still requires security review, license review and an approved OCI image digest."],"pack_type":"EcoKure runtime vulnerability audit EvidencePack","verification_state":"LOCK_BOUND_PIP_AUDIT"}