{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:51:59.769918Z","repo":{"ref":{"host":"github.com","owner":"0xD8C4A475","name":"liberated-mjpeg"},"default_branch":"main","clone_url":"https://github.com/0xD8C4A475/liberated-mjpeg.git","html_url":"https://github.com/0xD8C4A475/liberated-mjpeg","description":"An AI-generated MJPEG decoder, liberated from human-written code. Benchmarked against FFmpeg. The robots did their best.","stars":0,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":604,"primary_language":"C","license_spdx":"Unlicense","created_at":"2026-03-13T09:55:09Z","pushed_at":"2026-03-13T10:40:21Z","security_policy_url":null,"distribution":{"owner_created_at":"2013-03-09T19:22:00Z","owner_type":"User","release_assets":[]}},"commit_sha":"efd1458f1a4049d15d487541a70204cc4f96a184","profile":{"lines_by_language":{"C":4151,"Python":1038,"Shell":137},"files_by_category":{"source":28,"binary":4,"test":4,"config":3,"docs":3,"other":2},"source_lines":4257,"test_lines":1069},"pillars":{"ai_provenance":{"score":100.0,"confidence":0.71,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":1.0,"suspected_share":0.0,"estimated_share":1.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":3.289},"summary":"Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals."},"quality":{"score":54.5,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":29.8,"duplication":85.1,"lint":74.6,"testing":42.6,"docs":65.0,"type_safety":40.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.25, no CI test run detected; 40% of function code in complex or long functions; 3% duplicated lines. Weakest area: complexity."},"security":{"score":65.1,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":54.0,"dependencies":null,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 6 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":3.0,"attributed_commits":2.0,"attributed_commit_share":0.6666666666666666,"effective_loc":5338.0,"attributed_loc":5338.0,"attributed_loc_share":1.0,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 2 attributed commits, 5,338 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"efd1458f1a4049d15d487541a70204cc4f96a184","url":"https://github.com/0xD8C4A475/liberated-mjpeg/commit/efd1458f1a4049d15d487541a70204cc4f96a184","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"86570f638e7a98d32e196f00775b34c713075d7e","url":"https://github.com/0xD8C4A475/liberated-mjpeg/commit/86570f638e7a98d32e196f00775b34c713075d7e","weight":0.9}],"data":{"attributed_loc_by_commit":{"86570f638e7a98d32e196f00775b34c713075d7e":4292,"efd1458f1a4049d15d487541a70204cc4f96a184":1046},"tools":{"claude-code":{"name":"Claude Code","commits":2,"loc":5338,"first_seen":1773395914,"last_seen":1773398412}},"monthly":{"2026-03":{"loc":5338,"attributed_loc":5338}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":1.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":1046.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":261.5,"median_loc_per_hour":261.5,"pr_timed_units":0.0,"excluded_import_loc":4292.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["86570f638e7a98d32e196f00775b34c713075d7e"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":4257.0,"index":3.289,"count:narrated_steps":14.0,"per_kloc:narrated_steps":3.289,"files:narrated_steps":3.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: /* Step 1: Dequantize (coefficients are in zigzag order, output in natural order) */","ref":"src/idct.c:42","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/src/idct.c#L42","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: /* Step 2: 2D IDCT */","ref":"src/idct.c:48","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/src/idct.c#L48","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: /* Step 3: Level shift (add 128) and clamp */","ref":"src/idct.c:73","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/src/idct.c#L73","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: /* Step 1: Dequantize and de-zigzag into workspace (natural order) */","ref":"src/idct_fast.c:125","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/src/idct_fast.c#L125","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: /* Step 2: 1D IDCT on each row */","ref":"src/idct_fast.c:134","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/src/idct_fast.c#L134","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: /* Step 3: Transpose so column IDCT becomes row IDCT */","ref":"src/idct_fast.c:149","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/src/idct_fast.c#L149","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: /* Step 4: 1D IDCT on each column (now rows after transpose) */","ref":"src/idct_fast.c:155","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/src/idct_fast.c#L155","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: /* Step 5: Transpose back, level shift (+128), and clamp */","ref":"src/idct_fast.c:169","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/src/idct_fast.c#L169","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":18.0,"findings_high":6.0,"findings_medium":12.0,"findings_low":0.0,"weighted_findings":7.5,"scanned_lines":4257.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/benchmark.py","line":52,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/benchmark.py:52"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/benchmark.py","line":70,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/benchmark.py:70"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/benchmark.py","line":111,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/benchmark.py:111"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/validate_quality.py","line":40,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/validate_quality.py:40"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/validate_quality.py","line":72,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/validate_quality.py:72"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/validate_quality.py","line":89,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/validate_quality.py:89"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"src/huffman.c","line":21,"fingerprint":"c.lang.security.insecure-use-memset:src/huffman.c:21"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"src/huffman_fast.c","line":18,"fingerprint":"c.lang.security.insecure-use-memset:src/huffman_fast.c:18"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"src/jpeg_decoder.c","line":64,"fingerprint":"c.lang.security.insecure-use-memset:src/jpeg_decoder.c:64"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"src/jpeg_decoder.c","line":65,"fingerprint":"c.lang.security.insecure-use-memset:src/jpeg_decoder.c:65"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"src/jpeg_decoder.c","line":66,"fingerprint":"c.lang.security.insecure-use-memset:src/jpeg_decoder.c:66"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"src/jpeg_decoder.c","line":67,"fingerprint":"c.lang.security.insecure-use-memset:src/jpeg_decoder.c:67"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"src/jpeg_decoder.c","line":134,"fingerprint":"c.lang.security.insecure-use-memset:src/jpeg_decoder.c:134"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"src/jpeg_decoder.c","line":151,"fingerprint":"c.lang.security.insecure-use-memset:src/jpeg_decoder.c:151"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"src/jpeg_parser.c","line":270,"fingerprint":"c.lang.security.insecure-use-memset:src/jpeg_parser.c:270"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"tools/cmj_bench.c","line":114,"fingerprint":"c.lang.security.insecure-use-memset:tools/cmj_bench.c:114"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"tools/cmj_bench.c","line":169,"fingerprint":"c.lang.security.insecure-use-memset:tools/cmj_bench.c:169"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"tools/cmj_decode.c","line":105,"fingerprint":"c.lang.security.insecure-use-memset:tools/cmj_decode.c:105"}],"evidence":[],"data":{"rulesets":["c","python","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.3333,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":94.0,"function_nloc":2361.0,"mean_ccn":6.39,"p90_ccn":12.0,"complex_functions":8.0,"long_functions":4.0,"many_param_functions":0.0,"risky_nloc_share":0.4036},"findings":[],"evidence":[{"kind":"complex-function","description":"jpeg_decode in src/jpeg_decoder.c: complexity 50, 181 lines","ref":"src/jpeg_decoder.c","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/src/jpeg_decoder.c#L34","weight":0.8333333333333334},{"kind":"complex-function","description":"avi_open in src/avi_demuxer.c: complexity 44, 158 lines","ref":"src/avi_demuxer.c","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/src/avi_demuxer.c#L55","weight":0.7333333333333333},{"kind":"complex-function","description":"jpeg_parse in src/jpeg_parser.c: complexity 34, 78 lines","ref":"src/jpeg_parser.c","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/src/jpeg_parser.c#L265","weight":0.5666666666666667},{"kind":"complex-function","description":"idct_fast_dequant_block in src/idct_fast.c: complexity 24, 43 lines","ref":"src/idct_fast.c","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/src/idct_fast.c#L121","weight":0.4},{"kind":"complex-function","description":"generate_charts in scripts/benchmark.py: complexity 20, 125 lines","ref":"scripts/benchmark.py","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/scripts/benchmark.py#L142","weight":0.3333333333333333},{"kind":"complex-function","description":"main in tools/cmj_bench.c: complexity 18, 56 lines","ref":"tools/cmj_bench.c","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/tools/cmj_bench.c#L301","weight":0.3},{"kind":"complex-function","description":"main in scripts/benchmark.py: complexity 16, 82 lines","ref":"scripts/benchmark.py","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/scripts/benchmark.py#L304","weight":0.26666666666666666},{"kind":"complex-function","description":"main in scripts/validate_quality.py: complexity 16, 77 lines","ref":"scripts/validate_quality.py","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/scripts/validate_quality.py#L230","weight":0.26666666666666666},{"kind":"complex-function","description":"main in scripts/generate_charts.py: complexity 15, 153 lines","ref":"scripts/generate_charts.py","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/scripts/generate_charts.py#L12","weight":0.25}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":2914.0,"duplicated_lines":78.0,"duplicated_share":0.0268,"files":28.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/benchmark.py:50 and scripts/validate_quality.py:38","ref":"scripts/benchmark.py","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/scripts/benchmark.py#L50","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/benchmark.py:157 and scripts/generate_charts.py:24","ref":"scripts/benchmark.py","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/scripts/benchmark.py#L157","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/jpeg_parser.c:91 and src/jpeg_parser.c:139","ref":"src/jpeg_parser.c","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/src/jpeg_parser.c#L91","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: tools/cmj_bench.c:76 and tools/cmj_decode.c:46","ref":"tools/cmj_bench.c","url":"https://github.com/0xD8C4A475/liberated-mjpeg/blob/efd1458f1a4049d15d487541a70204cc4f96a184/tools/cmj_bench.c#L76","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":5.0,"weighted_findings":5.0,"scanned_lines":4257.0,"category:best-practice":4.0,"category:correctness":1.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"bench_plot.py","line":12,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:bench_plot.py:12"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/benchmark.py","line":388,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/benchmark.py:388"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/generate_charts.py","line":19,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/generate_charts.py:19"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/validate_quality.py","line":314,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/validate_quality.py:314"},{"rule_id":"opengrep/c.lang.correctness.incorrect-use-ato-fn","severity":"medium","message":"Avoid the 'ato*()' family of functions. Their use can lead to undefined behavior, integer overflows, and lack of appropriate error handling. Instead prefer the 'strtol*()' family of functions.","path":"tools/cmj_bench.c","line":326,"fingerprint":"c.lang.correctness.incorrect-use-ato-fn:tools/cmj_bench.c:326"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.5022,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":1069.0,"source_lines":4257.0,"test_ratio":0.2511,"ci_files":0.0,"cochange_share":0.5,"cochange_commits":2.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":196.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":4257.0,"other_lines":0.0,"files_blamed":28.0,"blame_failures":0.0,"quality:ai_findings":5.0,"quality:ai_per_kloc":1.175,"quality:other_findings":0.0,"security:ai_findings":18.0,"security:ai_per_kloc":4.228,"security:other_findings":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":["unreviewed-ai-risk"]}