{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:59:59.775064Z","repo":{"ref":{"host":"github.com","owner":"0Chencc","name":"clawgod"},"default_branch":"main","clone_url":"https://github.com/0Chencc/clawgod.git","html_url":"https://github.com/0Chencc/clawgod","description":"ClawGod is a runtime patch applied to the official Claude Code. It continues to be supported with each version update.","stars":2302,"forks":366,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":806,"primary_language":"JavaScript","license_spdx":"GPL-3.0","created_at":"2026-04-01T11:09:07Z","pushed_at":"2026-11-12T16:01:44Z","security_policy_url":null,"distribution":{"owner_created_at":"2016-05-14T14:35:16Z","owner_type":"User","release_assets":[{"name":"clawgod-import-darwin-arm64","size":1484480,"download_count":446,"release_tag":"v2.3.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.3.0/clawgod-import-darwin-arm64"},{"name":"clawgod-import-darwin-x64","size":1660304,"download_count":35,"release_tag":"v2.3.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.3.0/clawgod-import-darwin-x64"},{"name":"clawgod-import-linux-arm64","size":1643488,"download_count":46,"release_tag":"v2.3.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.3.0/clawgod-import-linux-arm64"},{"name":"clawgod-import-linux-x64","size":1867896,"download_count":808,"release_tag":"v2.3.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.3.0/clawgod-import-linux-x64"},{"name":"clawgod-import-windows-x64.exe","size":1752576,"download_count":1403,"release_tag":"v2.3.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.3.0/clawgod-import-windows-x64.exe"},{"name":"install.ps1","size":438709,"download_count":3012,"release_tag":"v2.3.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.3.0/install.ps1"},{"name":"install.sh","size":425530,"download_count":2253,"release_tag":"v2.3.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.3.0/install.sh"},{"name":"clawgod-import-darwin-arm64","size":1484464,"download_count":159,"release_tag":"v2.2.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.2.0/clawgod-import-darwin-arm64"},{"name":"clawgod-import-darwin-x64","size":1660304,"download_count":6,"release_tag":"v2.2.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.2.0/clawgod-import-darwin-x64"},{"name":"clawgod-import-linux-arm64","size":1643488,"download_count":9,"release_tag":"v2.2.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.2.0/clawgod-import-linux-arm64"},{"name":"clawgod-import-linux-x64","size":1868152,"download_count":290,"release_tag":"v2.2.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.2.0/clawgod-import-linux-x64"},{"name":"clawgod-import-windows-x64.exe","size":1753088,"download_count":314,"release_tag":"v2.2.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.2.0/clawgod-import-windows-x64.exe"},{"name":"install.ps1","size":436069,"download_count":824,"release_tag":"v2.2.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.2.0/install.ps1"},{"name":"install.sh","size":422893,"download_count":489,"release_tag":"v2.2.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.2.0/install.sh"},{"name":"clawgod-import-darwin-arm64","size":1484464,"download_count":63,"release_tag":"v2.1.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.1.0/clawgod-import-darwin-arm64"},{"name":"clawgod-import-darwin-x64","size":1660304,"download_count":7,"release_tag":"v2.1.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.1.0/clawgod-import-darwin-x64"},{"name":"clawgod-import-linux-arm64","size":1643488,"download_count":8,"release_tag":"v2.1.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.1.0/clawgod-import-linux-arm64"},{"name":"clawgod-import-linux-x64","size":1868152,"download_count":100,"release_tag":"v2.1.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.1.0/clawgod-import-linux-x64"},{"name":"clawgod-import-windows-x64.exe","size":1753088,"download_count":181,"release_tag":"v2.1.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.1.0/clawgod-import-windows-x64.exe"},{"name":"install.ps1","size":432109,"download_count":438,"release_tag":"v2.1.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.1.0/install.ps1"},{"name":"install.sh","size":418936,"download_count":329,"release_tag":"v2.1.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.1.0/install.sh"},{"name":"clawgod-import-darwin-arm64","size":1484464,"download_count":10,"release_tag":"v2.0.4","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.4/clawgod-import-darwin-arm64"},{"name":"clawgod-import-darwin-x64","size":1660304,"download_count":3,"release_tag":"v2.0.4","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.4/clawgod-import-darwin-x64"},{"name":"clawgod-import-linux-arm64","size":1643488,"download_count":3,"release_tag":"v2.0.4","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.4/clawgod-import-linux-arm64"},{"name":"clawgod-import-linux-x64","size":1868152,"download_count":9,"release_tag":"v2.0.4","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.4/clawgod-import-linux-x64"},{"name":"clawgod-import-windows-x64.exe","size":1753088,"download_count":20,"release_tag":"v2.0.4","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.4/clawgod-import-windows-x64.exe"},{"name":"install.ps1","size":188647,"download_count":49,"release_tag":"v2.0.4","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.4/install.ps1"},{"name":"install.sh","size":175425,"download_count":53,"release_tag":"v2.0.4","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.4/install.sh"},{"name":"clawgod-import-darwin-arm64","size":1484464,"download_count":40,"release_tag":"v2.0.3","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.3/clawgod-import-darwin-arm64"},{"name":"clawgod-import-darwin-x64","size":1660304,"download_count":8,"release_tag":"v2.0.3","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.3/clawgod-import-darwin-x64"},{"name":"clawgod-import-linux-arm64","size":1643488,"download_count":10,"release_tag":"v2.0.3","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.3/clawgod-import-linux-arm64"},{"name":"clawgod-import-linux-x64","size":1868152,"download_count":55,"release_tag":"v2.0.3","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.3/clawgod-import-linux-x64"},{"name":"clawgod-import-windows-x64.exe","size":1753088,"download_count":137,"release_tag":"v2.0.3","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.3/clawgod-import-windows-x64.exe"},{"name":"install.ps1","size":185822,"download_count":263,"release_tag":"v2.0.3","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.3/install.ps1"},{"name":"install.sh","size":172647,"download_count":155,"release_tag":"v2.0.3","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.3/install.sh"},{"name":"clawgod-import-darwin-arm64","size":1467904,"download_count":184,"release_tag":"v2.0.2","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.2/clawgod-import-darwin-arm64"},{"name":"clawgod-import-darwin-x64","size":1664384,"download_count":15,"release_tag":"v2.0.2","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.2/clawgod-import-darwin-x64"},{"name":"clawgod-import-linux-arm64","size":1643360,"download_count":32,"release_tag":"v2.0.2","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.2/clawgod-import-linux-arm64"},{"name":"clawgod-import-linux-x64","size":1872992,"download_count":255,"release_tag":"v2.0.2","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.2/clawgod-import-linux-x64"},{"name":"clawgod-import-windows-x64.exe","size":1751552,"download_count":469,"release_tag":"v2.0.2","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.2/clawgod-import-windows-x64.exe"},{"name":"install.ps1","size":179804,"download_count":1368,"release_tag":"v2.0.2","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.2/install.ps1"},{"name":"install.sh","size":168702,"download_count":893,"release_tag":"v2.0.2","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.2/install.sh"},{"name":"clawgod-import-darwin-arm64","size":1467904,"download_count":6,"release_tag":"v2.0.1","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.1/clawgod-import-darwin-arm64"},{"name":"clawgod-import-darwin-x64","size":1664384,"download_count":5,"release_tag":"v2.0.1","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.1/clawgod-import-darwin-x64"},{"name":"clawgod-import-linux-arm64","size":1643360,"download_count":5,"release_tag":"v2.0.1","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.1/clawgod-import-linux-arm64"},{"name":"clawgod-import-linux-x64","size":1872992,"download_count":7,"release_tag":"v2.0.1","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.1/clawgod-import-linux-x64"},{"name":"clawgod-import-windows-x64.exe","size":1751552,"download_count":11,"release_tag":"v2.0.1","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.1/clawgod-import-windows-x64.exe"},{"name":"install.ps1","size":179149,"download_count":14,"release_tag":"v2.0.1","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.1/install.ps1"},{"name":"install.sh","size":168047,"download_count":6,"release_tag":"v2.0.1","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.1/install.sh"},{"name":"clawgod-import-darwin-arm64","size":1467904,"download_count":12,"release_tag":"v2.0.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.0/clawgod-import-darwin-arm64"},{"name":"clawgod-import-darwin-x64","size":1664384,"download_count":6,"release_tag":"v2.0.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.0/clawgod-import-darwin-x64"},{"name":"clawgod-import-linux-arm64","size":1643360,"download_count":7,"release_tag":"v2.0.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.0/clawgod-import-linux-arm64"},{"name":"clawgod-import-linux-x64","size":1872992,"download_count":13,"release_tag":"v2.0.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.0/clawgod-import-linux-x64"},{"name":"clawgod-import-windows-x64.exe","size":1751552,"download_count":21,"release_tag":"v2.0.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.0/clawgod-import-windows-x64.exe"},{"name":"install.ps1","size":174772,"download_count":50,"release_tag":"v2.0.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.0/install.ps1"},{"name":"install.sh","size":163486,"download_count":22,"release_tag":"v2.0.0","url":"https://github.com/0Chencc/clawgod/releases/download/v2.0.0/install.sh"},{"name":"clawgod-import-darwin-arm64","size":1467904,"download_count":30,"release_tag":"v1.10.0","url":"https://github.com/0Chencc/clawgod/releases/download/v1.10.0/clawgod-import-darwin-arm64"},{"name":"clawgod-import-darwin-x64","size":1664384,"download_count":6,"release_tag":"v1.10.0","url":"https://github.com/0Chencc/clawgod/releases/download/v1.10.0/clawgod-import-darwin-x64"},{"name":"clawgod-import-linux-arm64","size":1643360,"download_count":7,"release_tag":"v1.10.0","url":"https://github.com/0Chencc/clawgod/releases/download/v1.10.0/clawgod-import-linux-arm64"},{"name":"clawgod-import-linux-x64","size":1872992,"download_count":37,"release_tag":"v1.10.0","url":"https://github.com/0Chencc/clawgod/releases/download/v1.10.0/clawgod-import-linux-x64"},{"name":"clawgod-import-windows-x64.exe","size":1751552,"download_count":58,"release_tag":"v1.10.0","url":"https://github.com/0Chencc/clawgod/releases/download/v1.10.0/clawgod-import-windows-x64.exe"},{"name":"install.ps1","size":170637,"download_count":138,"release_tag":"v1.10.0","url":"https://github.com/0Chencc/clawgod/releases/download/v1.10.0/install.ps1"},{"name":"install.sh","size":159352,"download_count":97,"release_tag":"v1.10.0","url":"https://github.com/0Chencc/clawgod/releases/download/v1.10.0/install.sh"},{"name":"clawgod-import-darwin-arm64","size":1467904,"download_count":91,"release_tag":"v1.9.8","url":"https://github.com/0Chencc/clawgod/releases/download/v1.9.8/clawgod-import-darwin-arm64"},{"name":"clawgod-import-darwin-x64","size":1664384,"download_count":7,"release_tag":"v1.9.8","url":"https://github.com/0Chencc/clawgod/releases/download/v1.9.8/clawgod-import-darwin-x64"},{"name":"clawgod-import-linux-arm64","size":1643360,"download_count":13,"release_tag":"v1.9.8","url":"https://github.com/0Chencc/clawgod/releases/download/v1.9.8/clawgod-import-linux-arm64"},{"name":"clawgod-import-linux-x64","size":1872992,"download_count":122,"release_tag":"v1.9.8","url":"https://github.com/0Chencc/clawgod/releases/download/v1.9.8/clawgod-import-linux-x64"},{"name":"clawgod-import-windows-x64.exe","size":1751552,"download_count":250,"release_tag":"v1.9.8","url":"https://github.com/0Chencc/clawgod/releases/download/v1.9.8/clawgod-import-windows-x64.exe"},{"name":"install.ps1","size":166736,"download_count":655,"release_tag":"v1.9.8","url":"https://github.com/0Chencc/clawgod/releases/download/v1.9.8/install.ps1"},{"name":"install.sh","size":156310,"download_count":437,"release_tag":"v1.9.8","url":"https://github.com/0Chencc/clawgod/releases/download/v1.9.8/install.sh"}]}},"commit_sha":"a08cfc96c7a226e2a7150bcb532f9945c15ee032","profile":{"lines_by_language":{"JavaScript":13235,"PowerShell":12279,"Shell":11753,"Python":691,"Rust":478,"TypeScript":211},"files_by_category":{"docs":32,"source":30,"test":17,"config":15,"other":12,"generated":2,"binary":1},"source_lines":35282,"test_lines":3365},"pillars":{"ai_provenance":{"score":0.3,"confidence":0.65,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0028,"suspected_share":0.6723,"estimated_share":0.0028,"ai_artifacts":1.0,"flagged_work_units":3.0,"flagged_releases":1.0},"summary":"Weak signals consistent with AI-assisted development. 2 commit(s) carry explicit AI attribution, too few to characterize the codebase."},"quality":{"score":54.8,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":42.8,"duplication":0.4,"lint":83.5,"testing":69.8,"docs":80.0,"type_safety":54.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.10, CI runs tests; 28% of function code in complex or long functions; 93% duplicated lines. Weakest area: duplication."},"security":{"score":59.7,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":93.5,"dependencies":49.7,"ci_actions":0.7,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 21 known vulnerabilities in 8 dependencies; 3 high-severity SAST findings; 24 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":7.0,"checked":7.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":145.0,"attributed_commits":2.0,"attributed_commit_share":0.013793103448275862,"effective_loc":57843.0,"attributed_loc":164.0,"attributed_loc_share":0.0028352609650260188,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 2 attributed commits, 164 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"fddda02630e67ff9274c4f4aad4386e47b33497b","url":"https://github.com/0Chencc/clawgod/commit/fddda02630e67ff9274c4f4aad4386e47b33497b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"5fb2572422588efac687ab970010f9121809951c","url":"https://github.com/0Chencc/clawgod/commit/5fb2572422588efac687ab970010f9121809951c","weight":0.9}],"data":{"attributed_loc_by_commit":{"5fb2572422588efac687ab970010f9121809951c":50,"fddda02630e67ff9274c4f4aad4386e47b33497b":114},"tools":{"claude-code":{"name":"Claude Code","commits":2,"loc":164,"first_seen":1784804756,"last_seen":1791704142}},"monthly":{"2026-04":{"loc":3965,"attributed_loc":0},"2026-05":{"loc":1177,"attributed_loc":0},"2026-06":{"loc":753,"attributed_loc":0},"2026-07":{"loc":1900,"attributed_loc":50},"2026-08":{"loc":4688,"attributed_loc":0},"2026-09":{"loc":7412,"attributed_loc":0},"2026-10":{"loc":37948,"attributed_loc":114}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1789738779.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"generic-agent","path":"AGENTS.md","added_at":1789738779}],"workflows":[],"tools":["generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":89.0,"flagged_units":3.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":57843.0,"flagged_loc":38887.0,"flagged_loc_share":0.6722853240668707,"max_loc_per_hour":4989.25,"median_loc_per_hour":136.0332670403182,"pr_timed_units":2.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"19,957 lines of first-party code in ~4.0h (4,989 lines/hour, 1 commit session)","ref":"a1a91769f88a588a86e5f5c4083c787cd27950f2","url":"https://github.com/0Chencc/clawgod/commit/a1a91769f88a588a86e5f5c4083c787cd27950f2","weight":0.6},{"kind":"velocity-burst","description":"15,102 lines of first-party code in ~4.1h (3,701 lines/hour, 2 commit session)","ref":"a08cfc96c7a226e2a7150bcb532f9945c15ee032","url":"https://github.com/0Chencc/clawgod/commit/a08cfc96c7a226e2a7150bcb532f9945c15ee032","weight":0.6},{"kind":"velocity-burst","description":"3,828 lines of first-party code in ~5.1h (753 lines/hour, 4 commit session)","ref":"aba6be8948ee06903dbd68ad7c10ec0ff945f104","url":"https://github.com/0Chencc/clawgod/commit/aba6be8948ee06903dbd68ad7c10ec0ff945f104","weight":0.22579137083560893}],"data":{"flagged_loc_by_commit":{"7888abab9f48e5943df40122b24133d6336663c8":28,"0501b682541410a45bf7101d51dca831d9be5225":1,"87d23ba2eee742233624054b80e42ab8c4afa207":3557,"aba6be8948ee06903dbd68ad7c10ec0ff945f104":242,"a1a91769f88a588a86e5f5c4083c787cd27950f2":19957,"949c4c7e11a63333fd142bdd6a53ae4d08a990de":15036,"a08cfc96c7a226e2a7150bcb532f9945c15ee032":66},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":57.0,"flagged_releases":1.0,"max_loc_per_day":85368.0},"findings":[],"evidence":[{"kind":"release-burst","description":"v2.0.4 → v2.1.0: 19,957 lines in 0.66 days (30,162.2 lines/day)","ref":"v2.0.4...v2.1.0","url":"https://github.com/0Chencc/clawgod/compare/v2.0.4...v2.1.0","weight":0.4}],"data":{"releases":[{"from":"v1.0.0","to":"v1.0.1","loc":1004,"days":0.7,"loc_per_day":1431.8,"flagged":false},{"from":"v1.0.1","to":"v1.0.2","loc":46,"days":1.01,"loc_per_day":45.6,"flagged":false},{"from":"v1.0.2","to":"v1.0.3","loc":14,"days":0.04,"loc_per_day":336.0,"flagged":false},{"from":"v1.0.3","to":"v1.0.4","loc":20,"days":0.31,"loc_per_day":64.5,"flagged":false},{"from":"v1.0.4","to":"v1.0.5","loc":14,"days":1.28,"loc_per_day":11.0,"flagged":false},{"from":"v1.0.5","to":"v1.0.6","loc":960,"days":11.59,"loc_per_day":82.9,"flagged":false},{"from":"v1.0.6","to":"v1.0.7","loc":650,"days":10.89,"loc_per_day":59.7,"flagged":false},{"from":"v1.0.7","to":"v1.0.8","loc":87,"days":0.07,"loc_per_day":1242.9,"flagged":false},{"from":"v1.0.8","to":"v1.0.9","loc":304,"days":0.07,"loc_per_day":4060.9,"flagged":false},{"from":"v1.0.9","to":"v1.1.0","loc":12,"days":0.91,"loc_per_day":13.2,"flagged":false},{"from":"v1.1.0","to":"v1.1.1","loc":209,"days":0.06,"loc_per_day":3235.0,"flagged":false},{"from":"v1.1.1","to":"v1.1.2","loc":604,"days":0.94,"loc_per_day":639.4,"flagged":false},{"from":"v1.1.2","to":"v1.1.3","loc":37,"days":0.04,"loc_per_day":888.0,"flagged":false},{"from":"v1.1.3","to":"v1.1.4","loc":92,"days":10.31,"loc_per_day":8.9,"flagged":false},{"from":"v1.1.4","to":"v1.1.5","loc":37,"days":2.97,"loc_per_day":12.5,"flagged":false},{"from":"v1.1.5","to":"v1.1.6","loc":24,"days":4.84,"loc_per_day":5.0,"flagged":false},{"from":"v1.1.6","to":"v1.1.7","loc":923,"days":2.92,"loc_per_day":315.7,"flagged":false},{"from":"v1.1.7","to":"v1.1.8","loc":82,"days":8.38,"loc_per_day":9.8,"flagged":false},{"from":"v1.1.8","to":"v1.1.9","loc":20,"days":1.94,"loc_per_day":10.3,"flagged":false},{"from":"v1.1.9","to":"v1.1.10","loc":32,"days":3.67,"loc_per_day":8.7,"flagged":false},{"from":"v1.1.10","to":"v1.1.11","loc":3,"days":4.25,"loc_per_day":0.7,"flagged":false},{"from":"v1.1.11","to":"v1.1.12","loc":650,"days":4.51,"loc_per_day":144.1,"flagged":false},{"from":"v1.1.12","to":"v1.2.0","loc":4,"days":0.07,"loc_per_day":53.7,"flagged":false},{"from":"v1.2.0","to":"v1.2.1","loc":64,"days":9.96,"loc_per_day":6.4,"flagged":false},{"from":"v1.2.1","to":"v1.3.0","loc":132,"days":9.1,"loc_per_day":14.5,"flagged":false},{"from":"v1.3.0","to":"v1.3.1","loc":56,"days":1.5,"loc_per_day":37.2,"flagged":false},{"from":"v1.3.1","to":"v1.4.0","loc":34,"days":0.64,"loc_per_day":53.5,"flagged":false},{"from":"v1.4.0","to":"v1.4.1","loc":4,"days":1.02,"loc_per_day":3.9,"flagged":false},{"from":"v1.4.1","to":"v1.5.0","loc":139,"days":3.31,"loc_per_day":42.0,"flagged":false},{"from":"v1.5.0","to":"v1.5.1","loc":68,"days":0.04,"loc_per_day":1632.0,"flagged":false},{"from":"v1.5.1","to":"v1.6.0","loc":166,"days":0.04,"loc_per_day":3984.0,"flagged":false},{"from":"v1.6.0","to":"v1.6.1","loc":35,"days":0.72,"loc_per_day":48.8,"flagged":false},{"from":"v1.6.1","to":"v1.7.0","loc":1149,"days":10.28,"loc_per_day":111.8,"flagged":false},{"from":"v1.7.0","to":"v1.7.1","loc":26,"days":1.55,"loc_per_day":16.8,"flagged":false},{"from":"v1.7.1","to":"v1.7.2","loc":2,"days":0.04,"loc_per_day":48.0,"flagged":false},{"from":"v1.7.2","to":"v1.7.3","loc":30,"days":1.17,"loc_per_day":25.6,"flagged":false},{"from":"v1.7.3","to":"v1.7.4","loc":5,"days":1.2,"loc_per_day":4.2,"flagged":false},{"from":"v1.7.4","to":"v1.7.5","loc":54,"days":0.9,"loc_per_day":59.7,"flagged":false},{"from":"v1.7.5","to":"v1.8.0","loc":38,"days":29.17,"loc_per_day":1.3,"flagged":false},{"from":"v1.8.0","to":"v1.9.0","loc":822,"days":5.96,"loc_per_day":137.9,"flagged":false},{"from":"v1.9.0","to":"v1.9.1","loc":29,"days":0.55,"loc_per_day":52.6,"flagged":false},{"from":"v1.9.1","to":"v1.9.2","loc":3557,"days":0.04,"loc_per_day":85368.0,"flagged":false},{"from":"v1.9.2","to":"v1.9.3","loc":242,"days":0.04,"loc_per_day":5808.0,"flagged":false},{"from":"v1.9.3","to":"v1.9.4","loc":1826,"days":15.02,"loc_per_day":121.6,"flagged":false},{"from":"v1.9.4","to":"v1.9.5","loc":2522,"days":6.25,"loc_per_day":403.7,"flagged":false},{"from":"v1.9.5","to":"v1.9.6","loc":189,"days":0.7,"loc_per_day":268.6,"flagged":false},{"from":"v1.9.6","to":"v1.9.7","loc":204,"days":1.92,"loc_per_day":106.3,"flagged":false},{"from":"v1.9.7","to":"v1.9.8","loc":39,"days":4.13,"loc_per_day":9.4,"flagged":false},{"from":"v1.9.8","to":"v1.10.0","loc":639,"days":4.09,"loc_per_day":156.4,"flagged":false},{"from":"v1.10.0","to":"v2.0.0","loc":1298,"days":0.86,"loc_per_day":1513.6,"flagged":false},{"from":"v2.0.0","to":"v2.0.1","loc":590,"days":0.1,"loc_per_day":5696.3,"flagged":false},{"from":"v2.0.1","to":"v2.0.2","loc":105,"days":0.04,"loc_per_day":2520.0,"flagged":false},{"from":"v2.0.2","to":"v2.0.3","loc":728,"days":9.26,"loc_per_day":78.6,"flagged":false},{"from":"v2.0.3","to":"v2.0.4","loc":336,"days":1.65,"loc_per_day":203.7,"flagged":false},{"from":"v2.0.4","to":"v2.1.0","loc":19957,"days":0.66,"loc_per_day":30162.2,"flagged":true},{"from":"v2.1.0","to":"v2.2.0","loc":273,"days":2.71,"loc_per_day":100.9,"flagged":false},{"from":"v2.2.0","to":"v2.3.0","loc":296,"days":5.2,"loc_per_day":56.9,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":13664.0,"index":0.476,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":13.0,"per_kloc:emoji_in_code":0.951,"files:emoji_in_code":1.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":12.0,"findings_high":3.0,"findings_medium":8.0,"findings_low":1.0,"weighted_findings":4.5,"scanned_lines":23288.0,"parse_errors":2.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"src/ci/tui-smoke.py","line":39,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:src/ci/tui-smoke.py:39"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.ts","line":126,"fingerprint":"javascript.browser.security.insecure-document-method:web/src/main.ts:126"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `text.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"web/src/main.ts","line":126,"fingerprint":"javascript.browser.security.insecure-innerhtml:web/src/main.ts:126"},{"rule_id":"opengrep/bash.curl.security.curl-pipe-bash","severity":"medium","message":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checki [confidence low]","path":"install.sh","line":106,"fingerprint":"bash.curl.security.curl-pipe-bash:install.sh:106"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `words` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"src/shared/acorn.mjs","line":279,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/shared/acorn.mjs:279"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment","severity":"medium","message":"Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low]","path":"src/shared/acorn.mjs","line":2698,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment:src/shared/acorn.mjs:2698"},{"rule_id":"opengrep/javascript.lang.security.audit.incomplete-sanitization","severity":"medium","message":"`sentence.replace` method will only replace the first occurrence when used with a string argument ('\\n'). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag. [confidence low]","path":"src/shared/patch.mjs","line":649,"fingerprint":"javascript.lang.security.audit.incomplete-sanitization:src/shared/patch.mjs:649"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/shared/patch.mjs","line":920,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/shared/patch.mjs:920"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"src/shared/patch.mjs","line":929,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:src/shared/patch.mjs:929"},{"rule_id":"opengrep/bash.curl.security.curl-pipe-bash","severity":"medium","message":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checki [confidence low]","path":"src/templates/install.sh","line":106,"fingerprint":"bash.curl.security.curl-pipe-bash:src/templates/install.sh:106"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"web/src/main.ts","line":126,"fingerprint":"javascript.lang.security.html-in-template-string:web/src/main.ts:126"},{"rule_id":"opengrep/rust.lang.security.args","severity":"low","message":"args should not be used for security operations. From the docs: \"The first element is traditionally the path of the executable, but it can be set to arbitrary text, and might not even exist. This means this property should not be relied upon for security purposes.\" [confidence high]","path":"tools/provider-import/src/main.rs","line":463,"fingerprint":"rust.lang.security.args:tools/provider-import/src/main.rs:463"}],"evidence":[],"data":{"rulesets":["bash","javascript","python","rust","typescript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":8.0,"vulnerabilities":21.0,"vulns_critical":0.0,"vulns_high":7.0,"vulns_medium":8.0,"vulns_low":4.0,"vulns_unknown":2.0,"penalty":42.0},"findings":[{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-28wg-ghj8-5hjv","path":"web/package-lock.json","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-2v37-7h3g-55p8","path":"web/package-lock.json","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-xwg4-73v4-xw9w","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-xwg4-73v4-xw9w","path":"web/package-lock.json","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-xwg4-73v4-xw9w"},{"rule_id":"osv/GHSA-6g55-p6wh-862q","severity":"high","message":"postcss@8.5.10 (npm) is affected by GHSA-6g55-p6wh-862q","path":"web/package-lock.json","line":null,"fingerprint":"postcss@8.5.10 (npm):GHSA-6g55-p6wh-862q"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.5.10 (npm) is affected by GHSA-r28c-9q8g-f849","path":"web/package-lock.json","line":null,"fingerprint":"postcss@8.5.10 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"web/package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@7.3.2 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"web/package-lock.json","line":null,"fingerprint":"vite@7.3.2 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-2mjx-qc3c-rqvc","severity":"medium","message":"rustls@0.23.42 (crates.io) is affected by RUSTSEC-2026-0285, GHSA-2mjx-qc3c-rqvc","path":"tools/provider-import/Cargo.lock","line":null,"fingerprint":"rustls@0.23.42 (crates.io):GHSA-2mjx-qc3c-rqvc"},{"rule_id":"osv/GHSA-c8m5-c952-6cm4","severity":"medium","message":"rustls@0.23.42 (crates.io) is affected by RUSTSEC-2026-0346, GHSA-c8m5-c952-6cm4","path":"tools/provider-import/Cargo.lock","line":null,"fingerprint":"rustls@0.23.42 (crates.io):GHSA-c8m5-c952-6cm4"},{"rule_id":"osv/RUSTSEC-2026-0382","severity":"medium","message":"rustls-webpki@0.103.13 (crates.io) is affected by RUSTSEC-2026-0382","path":"tools/provider-import/Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.103.13 (crates.io):RUSTSEC-2026-0382"},{"rule_id":"osv/RUSTSEC-2026-0381","severity":"medium","message":"webpki-roots@1.0.8 (crates.io) is affected by RUSTSEC-2026-0381","path":"tools/provider-import/Cargo.lock","line":null,"fingerprint":"webpki-roots@1.0.8 (crates.io):RUSTSEC-2026-0381"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.5.10 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"web/package-lock.json","line":null,"fingerprint":"postcss@8.5.10 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@7.3.2 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"web/package-lock.json","line":null,"fingerprint":"vite@7.3.2 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-fx2h-pf6j-xcff","severity":"medium","message":"vite@7.3.2 (npm) is affected by GHSA-fx2h-pf6j-xcff","path":"web/package-lock.json","line":null,"fingerprint":"vite@7.3.2 (npm):GHSA-fx2h-pf6j-xcff"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@7.3.2 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"web/package-lock.json","line":null,"fingerprint":"vite@7.3.2 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@7.3.2 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"web/package-lock.json","line":null,"fingerprint":"vite@7.3.2 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-v6wh-96g9-6wx3","severity":"medium","message":"vite@7.3.2 (npm) is affected by GHSA-v6wh-96g9-6wx3","path":"web/package-lock.json","line":null,"fingerprint":"vite@7.3.2 (npm):GHSA-v6wh-96g9-6wx3"},{"rule_id":"osv/GHSA-h2v8-394m-p7vv","severity":"low","message":"rustls@0.23.42 (crates.io) is affected by RUSTSEC-2026-0348, GHSA-h2v8-394m-p7vv","path":"tools/provider-import/Cargo.lock","line":null,"fingerprint":"rustls@0.23.42 (crates.io):GHSA-h2v8-394m-p7vv"},{"rule_id":"osv/GHSA-w44r-93j7-qv28","severity":"low","message":"rustls@0.23.42 (crates.io) is affected by RUSTSEC-2026-0349, GHSA-w44r-93j7-qv28","path":"tools/provider-import/Cargo.lock","line":null,"fingerprint":"rustls@0.23.42 (crates.io):GHSA-w44r-93j7-qv28"},{"rule_id":"osv/GHSA-g7r4-m6w7-qqqr","severity":"low","message":"esbuild@0.27.7 (npm) is affected by GHSA-g7r4-m6w7-qqqr","path":"web/package-lock.json","line":null,"fingerprint":"esbuild@0.27.7 (npm):GHSA-g7r4-m6w7-qqqr"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@7.3.2 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"web/package-lock.json","line":null,"fingerprint":"vite@7.3.2 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["crates.io","npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":6.0,"findings":34.0,"findings_high":24.0,"findings_medium":6.0,"findings_low":4.0,"penalty":295.2},"findings":[{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/build-import.yml","line":10,"fingerprint":"excessive-permissions:.github/workflows/build-import.yml:10"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-import.yml","line":40,"fingerprint":"unpinned-uses:.github/workflows/build-import.yml:40"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-import.yml","line":71,"fingerprint":"unpinned-uses:.github/workflows/build-import.yml:71"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-import.yml","line":82,"fingerprint":"unpinned-uses:.github/workflows/build-import.yml:82"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/close-inactive-issues.yml","line":26,"fingerprint":"unpinned-uses:.github/workflows/close-inactive-issues.yml:26"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/close-inactive-issues.yml","line":30,"fingerprint":"unpinned-uses:.github/workflows/close-inactive-issues.yml:30"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/compat-daily.yml","line":32,"fingerprint":"excessive-permissions:.github/workflows/compat-daily.yml:32"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/compat-daily.yml","line":33,"fingerprint":"excessive-permissions:.github/workflows/compat-daily.yml:33"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/compat-daily.yml","line":42,"fingerprint":"unpinned-uses:.github/workflows/compat-daily.yml:42"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/compat-daily.yml","line":45,"fingerprint":"unpinned-uses:.github/workflows/compat-daily.yml:45"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/compat-daily.yml","line":122,"fingerprint":"unpinned-uses:.github/workflows/compat-daily.yml:122"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/compat-daily.yml","line":125,"fingerprint":"unpinned-uses:.github/workflows/compat-daily.yml:125"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/compat-daily.yml","line":137,"fingerprint":"unpinned-uses:.github/workflows/compat-daily.yml:137"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/compat-daily.yml","line":147,"fingerprint":"unpinned-uses:.github/workflows/compat-daily.yml:147"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/compat-daily.yml","line":440,"fingerprint":"unpinned-uses:.github/workflows/compat-daily.yml:440"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/compat-daily.yml","line":504,"fingerprint":"unpinned-uses:.github/workflows/compat-daily.yml:504"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/compat-daily.yml","line":507,"fingerprint":"unpinned-uses:.github/workflows/compat-daily.yml:507"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/compat-daily.yml","line":513,"fingerprint":"unpinned-uses:.github/workflows/compat-daily.yml:513"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/compat-daily.yml","line":534,"fingerprint":"unpinned-uses:.github/workflows/compat-daily.yml:534"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/compat-daily.yml","line":545,"fingerprint":"unpinned-uses:.github/workflows/compat-daily.yml:545"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/compat-daily.yml","line":797,"fingerprint":"unpinned-uses:.github/workflows/compat-daily.yml:797"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/compat-daily.yml","line":808,"fingerprint":"unpinned-uses:.github/workflows/compat-daily.yml:808"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":17,"fingerprint":"unpinned-uses:.github/workflows/release.yml:17"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":22,"fingerprint":"unpinned-uses:.github/workflows/release.yml:22"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/build-import.yml","line":40,"fingerprint":"artipacked:.github/workflows/build-import.yml:40"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/close-inactive-issues.yml","line":26,"fingerprint":"artipacked:.github/workflows/close-inactive-issues.yml:26"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/compat-daily.yml","line":42,"fingerprint":"artipacked:.github/workflows/compat-daily.yml:42"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/compat-daily.yml","line":122,"fingerprint":"artipacked:.github/workflows/compat-daily.yml:122"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/compat-daily.yml","line":504,"fingerprint":"artipacked:.github/workflows/compat-daily.yml:504"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":16,"fingerprint":"artipacked:.github/workflows/release.yml:16"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":46,"fingerprint":"template-injection:.github/workflows/release.yml:46"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":47,"fingerprint":"template-injection:.github/workflows/release.yml:47"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":48,"fingerprint":"template-injection:.github/workflows/release.yml:48"},{"rule_id":"zizmor/template-injection","severity":"info","message":"code injection via template expansion [confidence low]","path":".github/workflows/release.yml","line":88,"fingerprint":"template-injection:.github/workflows/release.yml:88"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0345,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":20.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v2.3.0 ships clawgod-import-windows-x64.exe (1403 downloads)","ref":"clawgod-import-windows-x64.exe","url":"https://github.com/0Chencc/clawgod/releases/download/v2.3.0/clawgod-import-windows-x64.exe","weight":0.0},{"kind":"binary-release-asset","description":"release v2.3.0 ships install.ps1 (3012 downloads)","ref":"install.ps1","url":"https://github.com/0Chencc/clawgod/releases/download/v2.3.0/install.ps1","weight":0.0},{"kind":"binary-release-asset","description":"release v2.2.0 ships clawgod-import-windows-x64.exe (314 downloads)","ref":"clawgod-import-windows-x64.exe","url":"https://github.com/0Chencc/clawgod/releases/download/v2.2.0/clawgod-import-windows-x64.exe","weight":0.0},{"kind":"binary-release-asset","description":"release v2.2.0 ships install.ps1 (824 downloads)","ref":"install.ps1","url":"https://github.com/0Chencc/clawgod/releases/download/v2.2.0/install.ps1","weight":0.0},{"kind":"binary-release-asset","description":"release v2.1.0 ships clawgod-import-windows-x64.exe (181 downloads)","ref":"clawgod-import-windows-x64.exe","url":"https://github.com/0Chencc/clawgod/releases/download/v2.1.0/clawgod-import-windows-x64.exe","weight":0.0}],"data":{"signals":["binary-release-assets"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":671.0,"function_nloc":7281.0,"mean_ccn":5.03,"p90_ccn":11.0,"complex_functions":45.0,"long_functions":1.0,"many_param_functions":2.0,"risky_nloc_share":0.2831},"findings":[],"evidence":[{"kind":"complex-function","description":"(anonymous) in src/shared/ast-patches.mjs: complexity 87, 126 lines","ref":"src/shared/ast-patches.mjs","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/src/shared/ast-patches.mjs#L214","weight":1.0},{"kind":"complex-function","description":"pp$8.parseStatement in src/shared/acorn.mjs: complexity 51, 77 lines","ref":"src/shared/acorn.mjs","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/src/shared/acorn.mjs#L994","weight":0.85},{"kind":"complex-function","description":"pp$5.parseExprAtom in src/shared/acorn.mjs: complexity 48, 87 lines","ref":"src/shared/acorn.mjs","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/src/shared/acorn.mjs#L3032","weight":0.8},{"kind":"complex-function","description":"pp.getTokenFromCode in src/shared/acorn.mjs: complexity 47, 51 lines","ref":"src/shared/acorn.mjs","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/src/shared/acorn.mjs#L5765","weight":0.7833333333333333},{"kind":"complex-function","description":"pairingScopeResolver in src/shared/ast-patches.mjs: complexity 39, 47 lines","ref":"src/shared/ast-patches.mjs","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/src/shared/ast-patches.mjs#L76","weight":0.65},{"kind":"complex-function","description":"pp$8.parseClassElement in src/shared/acorn.mjs: complexity 34, 60 lines","ref":"src/shared/acorn.mjs","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/src/shared/acorn.mjs#L1581","weight":0.5666666666666667},{"kind":"complex-function","description":"run_case in src/ci/tui-smoke.py: complexity 33, 95 lines","ref":"src/ci/tui-smoke.py","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/src/ci/tui-smoke.py#L84","weight":0.55},{"kind":"complex-function","description":"startProxy in src/shared/openai-proxy.cjs: complexity 33, 60 lines","ref":"src/shared/openai-proxy.cjs","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/src/shared/openai-proxy.cjs#L263","weight":0.55},{"kind":"complex-function","description":"(anonymous) in src/shared/openai-proxy.cjs: complexity 33, 52 lines","ref":"src/shared/openai-proxy.cjs","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/src/shared/openai-proxy.cjs#L166","weight":0.55},{"kind":"complex-function","description":"pp$5.parsePropertyValue in src/shared/acorn.mjs: complexity 32, 35 lines","ref":"src/shared/acorn.mjs","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/src/shared/acorn.mjs#L3483","weight":0.5333333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":26886.0,"duplicated_lines":24946.0,"duplicated_share":0.9278,"files":30.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: install.ps1:1 and src/templates/install.ps1:1","ref":"install.ps1","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/install.ps1#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: install.ps1:224 and install.sh:170","ref":"install.ps1","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/install.ps1#L224","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: install.ps1:2202 and install.ps1:2278","ref":"install.ps1","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/install.ps1#L2202","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: install.ps1:6681 and src/windows/npm-fetch.mjs:1","ref":"install.ps1","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/install.ps1#L6681","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: install.sh:1 and src/templates/install.sh:1","ref":"install.sh","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/install.sh#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: install.sh:556 and src/shared/acorn.mjs:387","ref":"install.sh","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/install.sh#L556","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: install.sh:6676 and src/shared/extract-natives.mjs:1","ref":"install.sh","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/install.sh#L6676","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: install.sh:7142 and src/shared/post-process.mjs:14","ref":"install.sh","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/install.sh#L7142","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: install.sh:7360 and src/shared/openai-proxy.cjs:1","ref":"install.sh","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/install.sh#L7360","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: install.sh:7709 and src/shared/feature-gates.cjs:1","ref":"install.sh","url":"https://github.com/0Chencc/clawgod/blob/a08cfc96c7a226e2a7150bcb532f9945c15ee032/install.sh#L7709","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":43.0,"weighted_findings":16.75,"scanned_lines":23288.0,"category:best-practice":1.0,"category:correctness":42.0},"findings":[{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"src/shared/cli.cjs","line":184,"fingerprint":"javascript.lang.best-practice.lazy-load-module:src/shared/cli.cjs:184"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"src/shared/extract-natives.mjs","line":299,"fingerprint":"javascript.lang.correctness.no-replaceall:src/shared/extract-natives.mjs:299"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"src/shared/extract-natives.mjs","line":343,"fingerprint":"javascript.lang.correctness.no-replaceall:src/shared/extract-natives.mjs:343"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"src/shared/extract-natives.mjs","line":375,"fingerprint":"javascript.lang.correctness.no-replaceall:src/shared/extract-natives.mjs:375"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"src/shared/extract-natives.mjs","line":403,"fingerprint":"javascript.lang.correctness.no-replaceall:src/shared/extract-natives.mjs:403"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"src/shared/patch.mjs","line":904,"fingerprint":"javascript.lang.correctness.no-replaceall:src/shared/patch.mjs:904"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"src/shared/patch.mjs","line":921,"fingerprint":"javascript.lang.correctness.no-replaceall:src/shared/patch.mjs:921"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"src/shared/post-process.mjs","line":101,"fingerprint":"javascript.lang.correctness.no-replaceall:src/shared/post-process.mjs:101"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"build.js","line":3,"fingerprint":"javascript.lang.correctness.useless-assignment:build.js:3"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"build.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:build.js:9"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"docs/clawgod-handbook/hooks/setup.sh","line":113,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:docs/clawgod-handbook/hooks/setup.sh:113"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":113,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:113"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":124,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:124"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"src/ci/provider-startup-fixture.cjs","line":7,"fingerprint":"javascript.lang.correctness.useless-assignment:src/ci/provider-startup-fixture.cjs:7"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"src/shared/cli.cjs","line":2,"fingerprint":"javascript.lang.correctness.useless-assignment:src/shared/cli.cjs:2"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"src/shared/cli.cjs","line":3,"fingerprint":"javascript.lang.correctness.useless-assignment:src/shared/cli.cjs:3"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"src/shared/cli.cjs","line":4,"fingerprint":"javascript.lang.correctness.useless-assignment:src/shared/cli.cjs:4"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":126,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:126"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":126,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:126"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":149,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:149"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":149,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:149"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":214,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:214"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":214,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:214"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":225,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:225"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":225,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:225"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":233,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:233"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":233,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:233"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":284,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:284"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":284,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:284"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":302,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:302"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":302,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:302"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":397,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:397"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":397,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:397"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":512,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:512"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":512,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:512"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":537,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:537"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/patch.mjs","line":537,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/patch.mjs:537"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/shared/post-process.mjs","line":38,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/shared/post-process.mjs:38"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"src/shared/startup-check.cjs","line":4,"fingerprint":"javascript.lang.correctness.useless-assignment:src/shared/startup-check.cjs:4"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"src/shared/startup-check.cjs","line":5,"fingerprint":"javascript.lang.correctness.useless-assignment:src/shared/startup-check.cjs:5"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":"src/shared/startup-check.cjs","line":6,"fingerprint":"javascript.lang.correctness.useless-assignment:src/shared/startup-check.cjs:6"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"src/templates/install.sh","line":113,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:src/templates/install.sh:113"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"src/templates/install.sh","line":124,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:src/templates/install.sh:124"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.1907,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":3365.0,"source_lines":35282.0,"test_ratio":0.0954,"ci_files":6.0,"cochange_share":0.25,"cochange_commits":116.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/build-import.yml","ref":".github/workflows/build-import.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/cache-cleanup-weekly.yml","ref":".github/workflows/cache-cleanup-weekly.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/close-inactive-issues.yml","ref":".github/workflows/close-inactive-issues.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/compat-daily.yml","ref":".github/workflows/compat-daily.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/reject-readme-only.yml","ref":".github/workflows/reject-readme-only.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (bun test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["bun test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":204.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.2339,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: web/tsconfig.json","ref":"web/tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":97.0,"other_lines":35185.0,"files_blamed":30.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":43.0,"quality:other_per_kloc":1.222,"security:ai_findings":0.0,"security:ai_per_kloc":0.0,"security:other_findings":12.0,"security:other_per_kloc":0.341},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}