prowler-api

No clear malware or intentional sabotage is present. The code does contain potentially serious tenant-isolation and task-dispatch risks in functions marked bad, especially the unscoped admin query, client-controlled tenant ID, and caller-controlled Celery task name. Their exploitability depends on how these functions are exposed and on database, broker, and permission configuration.