Security
Secrets, execution and injection sinks
← Back to code signals AUTOMATED CODE SIGNAL v1
langchain-ai / langgraph
langgraph.
2 rule matches across 76 source files. This is a static snapshot—not a review of runtime behavior or a security certification.
AUTOMATED CODE SIGNAL
87/100
PASSEDNot a GAAAS certification · scanned October 4, 2026
76 source files checked2 findingsPARTIAL scan scopeStatic audit · manual review recommended
01 / SCORE BREAKDOWN
Where it stands.
Each pillar is worth 25 points. Deductions follow matched rules and are capped per pillar.
25/25
Cost guardrails
Loops, token limits and rate controls
Schema quality
Runtime validation of model output
Transparency
System context and sensitive logging
02 / SOURCE EVIDENCE
What the scan found.
Locations point to the public repository. Source snippets are omitted to avoid republishing exposed credentials.
MAJORCOST GUARDRAILS
Missing token limit
LLM request does not declare an output-token ceiling.
FIXSet max_tokens, maxOutputTokens, or the provider-equivalent limit on every request.
MAJORSCHEMA QUALITY
Missing structured-output schema
LLM output is consumed without an explicit runtime schema.
FIXDefine a Zod, JSON Schema, Pydantic, or provider-native structured-output schema.
03 / SHARE THE SIGNAL
Show the signal—accurately.
This badge identifies an automated code signal. Only a current signed certificate may use the GAAAS Verified mark.
[](https://gaaas.thanhdan.dev/agents/langchain-ai/langgraph)