Show 48 more MEDIUM findings
MEDIUM
D12
Hardcoded model name: 'Inject model configuration into the flow's Agent component.
Args:
flow_data: The flow JSON as a dict
provider: The provider name (e.g., "OpenAI", "Anthropic")
model_name: The model name (e.g., "gpt-4o", "claude-sonnet-4-5-20250929")
api_key_var: Optional API key variable name. If not provided, uses provider's default.
Returns:
Modified flow data with the model configuration injected
Raises:
ValueError: If provider is unknown
' — no routing/fallback
...ackend\base\langflow\agentic\services\flow_preparation.py:16
Use model routing or configuration instead of hardcoded names
MEDIUM
D12
Hardcoded model name: 'Load a Graph from a Python flow file.
The Python file must define a function `get_graph()` that returns a Graph.
The function can optionally accept provider, model_name, and api_key_var parameters.
Args:
flow_path: Path to the Python flow file.
provider: Optional model provider (e.g., "OpenAI").
model_name: Optional model name (e.g., "gpt-4o-mini").
api_key_var: Optional API key variable name.
Returns:
Graph: The loaded and configured graph.
Raises:
HTTPException: If the flow file cannot be loaded or executed.
' — no routing/fallback
...end\base\langflow\agentic\services\helpers\flow_loader.py:119
Use model routing or configuration instead of hardcoded names
MEDIUM
D5
print() used instead of structured logging
...w\alembic\versions\006b3990db50_add_unique_constraints.py:39
Use logging.* or structlog.* for structured, searchable logs
MEDIUM
D5
print() used instead of structured logging
...w\alembic\versions\006b3990db50_add_unique_constraints.py:62
Use logging.* or structlog.* for structured, searchable logs
MEDIUM
D5
print() used instead of structured logging
...sions\0882f9657f22_encrypt_existing_mcp_auth_settings_.py:68
Use logging.* or structlog.* for structured, searchable logs
MEDIUM
D5
print() used instead of structured logging
...sions\0882f9657f22_encrypt_existing_mcp_auth_settings_.py:72
Use logging.* or structlog.* for structured, searchable logs
MEDIUM
D5
print() used instead of structured logging
...sions\0882f9657f22_encrypt_existing_mcp_auth_settings_.py:118
Use logging.* or structlog.* for structured, searchable logs
MEDIUM
D5
print() used instead of structured logging
...sions\0882f9657f22_encrypt_existing_mcp_auth_settings_.py:122
Use logging.* or structlog.* for structured, searchable logs
MEDIUM
D5
print() used instead of structured logging
...ow\alembic\versions\2ac71eb9c3ae_adds_credential_table.py:41
Use logging.* or structlog.* for structured, searchable logs
MEDIUM
D5
print() used instead of structured logging
...ow\alembic\versions\2ac71eb9c3ae_adds_credential_table.py:51
Use logging.* or structlog.* for structured, searchable logs
MEDIUM
D5
print() used instead of structured logging
...alembic\versions\67cc006d50bf_add_profile_image_column.py:39
Use logging.* or structlog.* for structured, searchable logs
MEDIUM
D5
print() used instead of structured logging
...alembic\versions\67cc006d50bf_add_profile_image_column.py:54
Use logging.* or structlog.* for structured, searchable logs
MEDIUM
D5
print() used instead of structured logging
...e\langflow\alembic\versions\7843803a87b5_store_updates.py:52
Use logging.* or structlog.* for structured, searchable logs
MEDIUM
D5
print() used instead of structured logging
...\versions\7d2162acc8b2_adds_updated_at_and_folder_cols.py:34
Use logging.* or structlog.* for structured, searchable logs
MEDIUM
D5
print() used instead of structured logging
...\versions\7d2162acc8b2_adds_updated_at_and_folder_cols.py:43
Use logging.* or structlog.* for structured, searchable logs
MEDIUM
D5
print() used instead of structured logging
...\versions\7d2162acc8b2_adds_updated_at_and_folder_cols.py:60
Use logging.* or structlog.* for structured, searchable logs
MEDIUM
D5
print() used instead of structured logging
...\versions\7d2162acc8b2_adds_updated_at_and_folder_cols.py:66
Use logging.* or structlog.* for structured, searchable logs
MEDIUM
D5
print() used instead of structured logging
...mbic\versions\f5ee9749d1a6_user_id_can_be_null_in_flow.py:27
Use logging.* or structlog.* for structured, searchable logs
MEDIUM
D5
print() used instead of structured logging
...mbic\versions\f5ee9749d1a6_user_id_can_be_null_in_flow.py:38
Use logging.* or structlog.* for structured, searchable logs
MEDIUM
D5
print() used instead of structured logging
...low\alembic\versions\fd531f8868b1_fix_credential_table.py:36
Use logging.* or structlog.* for structured, searchable logs
MEDIUM
D5
print() used instead of structured logging
...low\alembic\versions\fd531f8868b1_fix_credential_table.py:55
Use logging.* or structlog.* for structured, searchable logs
MEDIUM
D12
Hardcoded model name: 'Expand a compact flow format to full flow format.
This endpoint takes a minimal flow representation (as generated by AI agents)
and expands it to the full format expected by the Langflow UI.
The compact format only requires:
- nodes: list of {id, type, values?}
- edges: list of {source, source_output, target, target_input}
The endpoint returns the full flow data with complete component templates.
Example input:
```json
{
"nodes": [
{"id": "1", "type": "ChatInput"},
{"id": "2", "type": "OpenAIModel", "values": {"model_name": "gpt-4"}}
],
"edges": [
{"source": "1", "source_output": "message", "target": "2", "target_input": "input_value"}
]
}
```
' — no routing/fallback
...\repos\langflow\src\backend\base\langflow\api\v1\flows.py:905
Use model routing or configuration instead of hardcoded names
MEDIUM
D12
Hardcoded model name: 'gpt-4o-transcribe' — no routing/fallback
...s\langflow\src\backend\base\langflow\api\v1\voice_mode.py:220
Use model routing or configuration instead of hardcoded names
MEDIUM
D12
Hardcoded model name: 'wss://api.openai.com/v1/realtime?model=gpt-4o-mini-realtime-preview' — no routing/fallback
...s\langflow\src\backend\base\langflow\api\v1\voice_mode.py:753
Use model routing or configuration instead of hardcoded names
MEDIUM
D12
Hardcoded model name: 'gpt-4o-mini-tts' — no routing/fallback
...s\langflow\src\backend\base\langflow\api\v1\voice_mode.py:1300
Use model routing or configuration instead of hardcoded names
MEDIUM
D12
Hardcoded model name: 'gpt-4o-mini' — no routing/fallback
...\langflow\initial_setup\starter_projects\complex_agent.py:12
Use model routing or configuration instead of hardcoded names
MEDIUM
D12
Hardcoded model name: 'gpt-4o' — no routing/fallback
...\langflow\initial_setup\starter_projects\complex_agent.py:13
Use model routing or configuration instead of hardcoded names
MEDIUM
D12
Hardcoded model name: 'gpt-4o-mini' — no routing/fallback
...nitial_setup\starter_projects\hierarchical_tasks_agent.py:12
Use model routing or configuration instead of hardcoded names
MEDIUM
D12
Hardcoded model name: 'gpt-4o' — no routing/fallback
...nitial_setup\starter_projects\hierarchical_tasks_agent.py:13
Use model routing or configuration instead of hardcoded names
MEDIUM
D12
Hardcoded model name: 'Expand a compact flow format to full flow format.
Args:
compact_data: The compact flow data with nodes and edges
all_types_dict: The component types dictionary from component_cache
Returns:
Full flow data structure ready for Langflow UI
Example compact input:
{
"nodes": [
{"id": "1", "type": "ChatInput"},
{"id": "2", "type": "OpenAIModel", "values": {"model_name": "gpt-4"}}
],
"edges": [
{"source": "1", "source_output": "message", "target": "2", "target_input": "input_value"}
]
}
' — no routing/fallback
...gflow\src\backend\base\langflow\processing\expand_flow.py:252
Use model routing or configuration instead of hardcoded names
MEDIUM
D12
Hardcoded model name: 'The source of the message. Normally used to display the model name (e.g. 'gpt-4o')' — no routing/fallback
...s\langflow\src\backend\base\langflow\schema\properties.py:11
Use model routing or configuration instead of hardcoded names
MEDIUM
D12
Hardcoded model name: 'Format a span name following the OTel semantic convention ``"{operation} {model}"``.
Args:
operation: Human-readable operation name (e.g. ``"ChatOpenAI"``).
model_name: Optional model identifier (e.g. ``"gpt-4o"``).
Returns:
``"{operation} {model_name}"`` when model is known, otherwise just
``operation``.
' — no routing/fallback
...backend\base\langflow\services\tracing\native_callback.py:139
Use model routing or configuration instead of hardcoded names
MEDIUM
D4
Exposed Database URL (no credentials): red...t}/0
...s\langflow\src\backend\base\langflow\core\celeryconfig.py:9
Move to secrets manager or .env file (excluded from VCS)
EU AI Act Article 15OWASP LLM09
MEDIUM
D4
Exposed Database URL (no credentials): red...t}/0
...s\langflow\src\backend\base\langflow\core\celeryconfig.py:10
Move to secrets manager or .env file (excluded from VCS)
EU AI Act Article 15OWASP LLM09
MEDIUM
D4
Exposed Database URL (no credentials): red...79/0
...s\langflow\src\backend\base\langflow\core\celeryconfig.py:16
Move to secrets manager or .env file (excluded from VCS)
EU AI Act Article 15OWASP LLM09
MEDIUM
D14
Unpinned AI dependency: openai
...en\gallery\repos\langflow\src\backend\base\pyproject.toml:7
Pin version: openai==<specific_version>
MEDIUM
D14
Unpinned AI dependency: langchain
...en\gallery\repos\langflow\src\backend\base\pyproject.toml:7
Pin version: langchain==<specific_version>
MEDIUM
D14
Unpinned AI dependency: openai
...en\gallery\repos\langflow\src\backend\base\pyproject.toml:385
Pin version: openai==<specific_version>
MEDIUM
D14
Unpinned AI dependency: anthropic
...en\gallery\repos\langflow\src\backend\base\pyproject.toml:386
Pin version: anthropic==<specific_version>
MEDIUM
D14
Unpinned AI dependency: litellm
...en\gallery\repos\langflow\src\backend\base\pyproject.toml:425
Pin version: litellm==<specific_version>
MEDIUM
D14
Unpinned AI dependency: langchain
...en\gallery\repos\langflow\src\backend\base\pyproject.toml:449
Pin version: langchain==<specific_version>
MEDIUM
D14
Unpinned AI dependency: langchain
...en\gallery\repos\langflow\src\backend\base\pyproject.toml:450
Pin version: langchain==<specific_version>
MEDIUM
D14
Unpinned AI dependency: langchain
...en\gallery\repos\langflow\src\backend\base\pyproject.toml:452
Pin version: langchain==<specific_version>
MEDIUM
D6
CrewAI agent without max_iter or timeout — unbounded execution
...\langflow\initial_setup\starter_projects\complex_agent.py:1
Set max_iter= and/or timeout= to prevent runaway agent loops
MEDIUM
D6
CrewAI agent without max_iter or timeout — unbounded execution
...nitial_setup\starter_projects\hierarchical_tasks_agent.py:1
Set max_iter= and/or timeout= to prevent runaway agent loops
MEDIUM
D17
No adversarial testing evidence — no red team, no prompt injection tests
Implement adversarial testing for agent systems
MEDIUM
D17
No tool-call attack simulation — agent tool calls not tested against adversarial inputs
Implement adversarial testing for agent systems
MEDIUM
D17
No multi-agent chaos engineering — agent swarms not stress tested
Implement adversarial testing for agent systems