Will It Vibe?requirements.txt VCS dependency with no pinned ref
Part of Dependencies & Hygiene, which counts for 10% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
A requirements.txt git+ dependency has no @ref (commit/tag/branch) after the repository URL, so pip installs whatever the default branch currently points to -- a floating, unreviewable install.
Why it matters
A requirements.txt git+ dependency with no commit/tag/branch ref after the repository URL floats to whatever the default branch currently points to. That means the exact code you install today can be different from what you install tomorrow, with no version bump, no changelog, and no way to know what changed -- the same reproducibility and trust problem as a wildcard registry version, but for a dependency that also skips the registry entirely.
How to fix it
Add a pinned ref after the repository URL: a commit SHA is the strongest guarantee (git+https://host/org/repo.git@<full-sha>#egg=name), a tag is nearly as good if the upstream project doesn't rewrite tags. Update the pin deliberately when you want to pick up new upstream changes.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo