Secrets
CheckedThe latest scan completed this check. It does not guarantee full coverage of the repository.
AI frameworks · Security report
Alerts to reviewcrewAIInc/crewAIIs crewAI safe to use?
Short answer
No scan can prove a project is safe. Our latest scan of crewAI flagged 37 automated alerts, all classified as Secrets, and 0 of them are high or critical. Review them before you run crewAI with real data or credentials.
- Automated alerts
- 37
- High or critical
- 0
- Most flagged
- Secrets
- Last scanned
Framework for orchestrating role-playing, autonomous AI agents. By fostering collaborative intelligence, CrewAI empowers agents to work together seamlessly, tackling complex tasks.
The assessment, at a glance
All 37 automated alerts are classified as Secrets
100% of the alerts in the current repository snapshot are classified as Secrets. 0 of all alerts are critical or high severity. Categories and severity are triage signals; these alerts have not been independently validated as vulnerabilities.
Repository snapshot from Plexicus staging. Counts may include earlier scans and are not attributed to an exact run or commit. Check categories come from the latest observed job and can differ from the scans contributing findings. Completed categories describe bundle delivery, not full repository coverage.
What we found
What the scan flagged
Alerts are leads for review, sorted by type and severity. They are not confirmed vulnerabilities.
Alerts by type
- Secrets100% of alerts
- 37
Types describe all current alerts for this repository, not only the latest scan.
Repository findings snapshot
Current repository findings
37automated alerts
Findings currently visible in the Plexicus repository record. These alerts have not been validated as vulnerabilities or attributed to this exact scan or commit.
- Critical
- 0
- High
- 0
- Medium
- 37
- Low
- 0
- Informational
- 0
Source: Plexicus staging · Collected
Scope and counting limits
These are current repository totals, which may include findings from earlier scans. Scan-specific counts and the scanned commit remain unverified. The snapshot excludes findings marked as false positives, duplicates, deleted, or sandbox results, and findings still awaiting processing or enrichment.
Next steps
How to use crewAI more safely
Practical steps based on what the scan flagged. They are general guidance, not confirmation of an exploitable vulnerability.
Triage the alerts to confirm validity, relevance, and impact.
Confirm false positives and duplicate root causes before using alert totals to prioritize work.
Secrets (37): validate suspected secrets privately. Revoke or rotate credentials only when exposure is confirmed, and never publish secret values.
Try it in a container or virtual machine first, with throwaway credentials.
Pin a specific release or commit instead of tracking the latest code.
This public report shows totals only. File names, exploitability, and false-positive rates are not included.
What we checked
Which checks ran?
Each card shows whether the latest scan completed that type of check. A completed check does not mean every file or rule was covered.
Code security
Not checkedDo not assume this area was assessed.
Dependencies
Not checkedDo not assume this area was assessed.
Configuration
Not checkedDo not assume this area was assessed.
Limits
What this report cannot tell you
- Alert totals can include results from earlier scans and are not tied to one exact commit.
- Automated alerts need investigation. Severity is a scanner's estimate, not a confirmed impact.
- Zero alerts means nothing was flagged in the checks that ran, not that the project is safe.
- Runtime behavior, deployment settings, MCP permissions, and prompt injection are not assessed unless listed above.
Technical scan record & repository metadata
- Platform execution
- Platform job completed
- Commit evidence
- Scanned commit not verified
- Last checked (UTC)
- 2026-10-16T05:03:37.350Z
- Default branch
- main
Result bundles: 1 of 1 complete; 0 failed; 0 degraded. Bundle completion alone does not establish full scan coverage.
Requested commit 6115839576d68d2e83b9f7f31e6c55d471e1fc64
Scan source fork: View fork ↗
Repository metadata retrieved 2026-10-15T08:14:43.977Z. Candidate commit from metadata: 3da2d4e9932b5f2fa9aa73ea9245e0f8b5c154f8. A candidate commit is not proof of the scanned commit.
Questions about crewAI
Is crewAI safe to use?
No scan can prove a project is safe. Our latest scan of crewAI flagged 37 automated alerts, all classified as Secrets, and 0 of them are high or critical. Review them before you run crewAI with real data or credentials.
What did Plexicus find in crewAI?
100% of the alerts in the current repository snapshot are classified as Secrets. 0 of all alerts are critical or high severity. Categories and severity are triage signals; these alerts have not been independently validated as vulnerabilities.
What did the scan not check?
Runtime behavior, deployment settings, MCP and tool permissions, and prompt injection are not covered unless listed in the checks above. Review those before giving the tool access to real data.
How can I check my own fork or project?
Scan it with the free Plexicus SAST tool. Connect GitHub and get a report for your own repository.
For maintainers
Add the crewAI security report to your README
Show users where to find this report. The badge links to this page and makes no safety claim.
[](https://www.plexicus.ai/open-source/crewaiinc/crewai/)Your own code
Scan your own repository for free.
Connect GitHub and see what Plexicus flags in your code.
Scan your repository free ↗