{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:00.133184Z","repo":{"ref":{"host":"github.com","owner":"Benehiko","name":"tidalt"},"default_branch":"main","clone_url":"https://github.com/Benehiko/tidalt.git","html_url":"https://github.com/Benehiko/tidalt","description":"Lossless bit-perfect Linux tidal player","stars":6,"forks":7,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":6080,"primary_language":"Go","license_spdx":"Apache-2.0","created_at":"2026-03-13T11:54:14Z","pushed_at":"2026-09-15T12:58:08Z","security_policy_url":null,"distribution":{"owner_created_at":"2016-03-23T15:26:05Z","owner_type":"User","release_assets":[{"name":"checksums.txt","size":753,"download_count":11,"release_tag":"v4.0.3","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.3/checksums.txt"},{"name":"tidalt-4.0.3-1-x86_64.pkg.tar.zst","size":5040884,"download_count":19,"release_tag":"v4.0.3","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.3/tidalt-4.0.3-1-x86_64.pkg.tar.zst"},{"name":"tidalt-4.0.3-1.fc44.aarch64.rpm","size":4386231,"download_count":4,"release_tag":"v4.0.3","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.3/tidalt-4.0.3-1.fc44.aarch64.rpm"},{"name":"tidalt-4.0.3-1.fc44.x86_64.rpm","size":4883508,"download_count":10,"release_tag":"v4.0.3","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.3/tidalt-4.0.3-1.fc44.x86_64.rpm"},{"name":"tidalt-debug-4.0.3-1-x86_64.pkg.tar.zst","size":5182946,"download_count":5,"release_tag":"v4.0.3","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.3/tidalt-debug-4.0.3-1-x86_64.pkg.tar.zst"},{"name":"tidalt-linux-amd64","size":14566936,"download_count":16,"release_tag":"v4.0.3","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.3/tidalt-linux-amd64"},{"name":"tidalt-linux-arm64","size":13272576,"download_count":5,"release_tag":"v4.0.3","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.3/tidalt-linux-arm64"},{"name":"tidalt_4.0.3-1_amd64.deb","size":4427748,"download_count":17,"release_tag":"v4.0.3","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.3/tidalt_4.0.3-1_amd64.deb"},{"name":"tidalt_4.0.3-1_arm64.deb","size":3802292,"download_count":5,"release_tag":"v4.0.3","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.3/tidalt_4.0.3-1_arm64.deb"},{"name":"checksums.txt","size":753,"download_count":9,"release_tag":"v4.0.2","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.2/checksums.txt"},{"name":"tidalt-4.0.2-1-x86_64.pkg.tar.zst","size":4787683,"download_count":18,"release_tag":"v4.0.2","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.2/tidalt-4.0.2-1-x86_64.pkg.tar.zst"},{"name":"tidalt-4.0.2-1.fc44.aarch64.rpm","size":4390699,"download_count":4,"release_tag":"v4.0.2","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.2/tidalt-4.0.2-1.fc44.aarch64.rpm"},{"name":"tidalt-4.0.2-1.fc44.x86_64.rpm","size":4882468,"download_count":5,"release_tag":"v4.0.2","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.2/tidalt-4.0.2-1.fc44.x86_64.rpm"},{"name":"tidalt-debug-4.0.2-1-x86_64.pkg.tar.zst","size":4865489,"download_count":2,"release_tag":"v4.0.2","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.2/tidalt-debug-4.0.2-1-x86_64.pkg.tar.zst"},{"name":"tidalt-linux-amd64","size":14558744,"download_count":21,"release_tag":"v4.0.2","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.2/tidalt-linux-amd64"},{"name":"tidalt-linux-arm64","size":13272576,"download_count":5,"release_tag":"v4.0.2","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.2/tidalt-linux-arm64"},{"name":"tidalt_4.0.2-1_amd64.deb","size":4424724,"download_count":14,"release_tag":"v4.0.2","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.2/tidalt_4.0.2-1_amd64.deb"},{"name":"tidalt_4.0.2-1_arm64.deb","size":3803340,"download_count":7,"release_tag":"v4.0.2","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.2/tidalt_4.0.2-1_arm64.deb"},{"name":"checksums.txt","size":753,"download_count":3,"release_tag":"v4.0.1","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.1/checksums.txt"},{"name":"tidalt-4.0.1-1-x86_64.pkg.tar.zst","size":4777104,"download_count":15,"release_tag":"v4.0.1","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.1/tidalt-4.0.1-1-x86_64.pkg.tar.zst"},{"name":"tidalt-4.0.1-1.fc44.aarch64.rpm","size":4381723,"download_count":2,"release_tag":"v4.0.1","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.1/tidalt-4.0.1-1.fc44.aarch64.rpm"},{"name":"tidalt-4.0.1-1.fc44.x86_64.rpm","size":4876433,"download_count":5,"release_tag":"v4.0.1","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.1/tidalt-4.0.1-1.fc44.x86_64.rpm"},{"name":"tidalt-debug-4.0.1-1-x86_64.pkg.tar.zst","size":4846582,"download_count":2,"release_tag":"v4.0.1","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.1/tidalt-debug-4.0.1-1-x86_64.pkg.tar.zst"},{"name":"tidalt-linux-amd64","size":14476696,"download_count":3,"release_tag":"v4.0.1","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.1/tidalt-linux-amd64"},{"name":"tidalt-linux-arm64","size":13206912,"download_count":1,"release_tag":"v4.0.1","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.1/tidalt-linux-arm64"},{"name":"tidalt_4.0.1-1_amd64.deb","size":4419932,"download_count":7,"release_tag":"v4.0.1","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.1/tidalt_4.0.1-1_amd64.deb"},{"name":"tidalt_4.0.1-1_arm64.deb","size":3796660,"download_count":0,"release_tag":"v4.0.1","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.1/tidalt_4.0.1-1_arm64.deb"},{"name":"checksums.txt","size":753,"download_count":1,"release_tag":"v4.0.0","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.0/checksums.txt"},{"name":"tidalt-4.0.0-1-x86_64.pkg.tar.zst","size":4758643,"download_count":2,"release_tag":"v4.0.0","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.0/tidalt-4.0.0-1-x86_64.pkg.tar.zst"},{"name":"tidalt-4.0.0-1.fc44.aarch64.rpm","size":4369163,"download_count":0,"release_tag":"v4.0.0","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.0/tidalt-4.0.0-1.fc44.aarch64.rpm"},{"name":"tidalt-4.0.0-1.fc44.x86_64.rpm","size":4862856,"download_count":0,"release_tag":"v4.0.0","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.0/tidalt-4.0.0-1.fc44.x86_64.rpm"},{"name":"tidalt-debug-4.0.0-1-x86_64.pkg.tar.zst","size":4833967,"download_count":0,"release_tag":"v4.0.0","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.0/tidalt-debug-4.0.0-1-x86_64.pkg.tar.zst"},{"name":"tidalt-linux-amd64","size":14386392,"download_count":0,"release_tag":"v4.0.0","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.0/tidalt-linux-amd64"},{"name":"tidalt-linux-arm64","size":13075680,"download_count":0,"release_tag":"v4.0.0","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.0/tidalt-linux-arm64"},{"name":"tidalt_4.0.0-1_amd64.deb","size":4403952,"download_count":1,"release_tag":"v4.0.0","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.0/tidalt_4.0.0-1_amd64.deb"},{"name":"tidalt_4.0.0-1_arm64.deb","size":3786808,"download_count":0,"release_tag":"v4.0.0","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.0/tidalt_4.0.0-1_arm64.deb"},{"name":"checksums.txt","size":753,"download_count":6,"release_tag":"v3.6.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.6.1/checksums.txt"},{"name":"tidalt-3.6.1-1-x86_64.pkg.tar.zst","size":4504807,"download_count":18,"release_tag":"v3.6.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.6.1/tidalt-3.6.1-1-x86_64.pkg.tar.zst"},{"name":"tidalt-3.6.1-1.fc43.aarch64.rpm","size":3501499,"download_count":3,"release_tag":"v3.6.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.6.1/tidalt-3.6.1-1.fc43.aarch64.rpm"},{"name":"tidalt-3.6.1-1.fc43.x86_64.rpm","size":3918221,"download_count":1,"release_tag":"v3.6.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.6.1/tidalt-3.6.1-1.fc43.x86_64.rpm"},{"name":"tidalt-debug-3.6.1-1-x86_64.pkg.tar.zst","size":3984266,"download_count":3,"release_tag":"v3.6.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.6.1/tidalt-debug-3.6.1-1-x86_64.pkg.tar.zst"},{"name":"tidalt-linux-amd64","size":11575080,"download_count":5,"release_tag":"v3.6.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.6.1/tidalt-linux-amd64"},{"name":"tidalt-linux-arm64","size":10637040,"download_count":2,"release_tag":"v3.6.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.6.1/tidalt-linux-arm64"},{"name":"tidalt_3.6.1-1_amd64.deb","size":3558696,"download_count":11,"release_tag":"v3.6.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.6.1/tidalt_3.6.1-1_amd64.deb"},{"name":"tidalt_3.6.1-1_arm64.deb","size":3033504,"download_count":5,"release_tag":"v3.6.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.6.1/tidalt_3.6.1-1_arm64.deb"},{"name":"checksums.txt","size":753,"download_count":1,"release_tag":"v3.6.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.6.0/checksums.txt"},{"name":"tidalt-3.6.0-1-x86_64.pkg.tar.zst","size":4504797,"download_count":0,"release_tag":"v3.6.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.6.0/tidalt-3.6.0-1-x86_64.pkg.tar.zst"},{"name":"tidalt-3.6.0-1.fc43.aarch64.rpm","size":3502813,"download_count":0,"release_tag":"v3.6.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.6.0/tidalt-3.6.0-1.fc43.aarch64.rpm"},{"name":"tidalt-3.6.0-1.fc43.x86_64.rpm","size":3918534,"download_count":0,"release_tag":"v3.6.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.6.0/tidalt-3.6.0-1.fc43.x86_64.rpm"},{"name":"tidalt-debug-3.6.0-1-x86_64.pkg.tar.zst","size":3984254,"download_count":0,"release_tag":"v3.6.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.6.0/tidalt-debug-3.6.0-1-x86_64.pkg.tar.zst"},{"name":"tidalt-linux-amd64","size":11575080,"download_count":0,"release_tag":"v3.6.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.6.0/tidalt-linux-amd64"},{"name":"tidalt-linux-arm64","size":10637040,"download_count":0,"release_tag":"v3.6.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.6.0/tidalt-linux-arm64"},{"name":"tidalt_3.6.0-1_amd64.deb","size":3556808,"download_count":0,"release_tag":"v3.6.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.6.0/tidalt_3.6.0-1_amd64.deb"},{"name":"tidalt_3.6.0-1_arm64.deb","size":3035016,"download_count":0,"release_tag":"v3.6.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.6.0/tidalt_3.6.0-1_arm64.deb"},{"name":"checksums.txt","size":753,"download_count":1,"release_tag":"v3.5.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.5.1/checksums.txt"},{"name":"tidalt-3.5.1-1-x86_64.pkg.tar.zst","size":4503818,"download_count":6,"release_tag":"v3.5.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.5.1/tidalt-3.5.1-1-x86_64.pkg.tar.zst"},{"name":"tidalt-3.5.1-1.fc43.aarch64.rpm","size":3501344,"download_count":9,"release_tag":"v3.5.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.5.1/tidalt-3.5.1-1.fc43.aarch64.rpm"},{"name":"tidalt-3.5.1-1.fc43.x86_64.rpm","size":3918496,"download_count":9,"release_tag":"v3.5.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.5.1/tidalt-3.5.1-1.fc43.x86_64.rpm"},{"name":"tidalt-debug-3.5.1-1-x86_64.pkg.tar.zst","size":3985237,"download_count":2,"release_tag":"v3.5.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.5.1/tidalt-debug-3.5.1-1-x86_64.pkg.tar.zst"},{"name":"tidalt-linux-amd64","size":11575080,"download_count":3,"release_tag":"v3.5.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.5.1/tidalt-linux-amd64"},{"name":"tidalt-linux-arm64","size":10637072,"download_count":2,"release_tag":"v3.5.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.5.1/tidalt-linux-arm64"},{"name":"tidalt_3.5.1-1_amd64.deb","size":3554156,"download_count":2,"release_tag":"v3.5.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.5.1/tidalt_3.5.1-1_amd64.deb"},{"name":"tidalt_3.5.1-1_arm64.deb","size":3036180,"download_count":3,"release_tag":"v3.5.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.5.1/tidalt_3.5.1-1_arm64.deb"},{"name":"checksums.txt","size":753,"download_count":0,"release_tag":"v3.5.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.5.0/checksums.txt"},{"name":"tidalt-3.5.0-1-x86_64.pkg.tar.zst","size":4477636,"download_count":3,"release_tag":"v3.5.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.5.0/tidalt-3.5.0-1-x86_64.pkg.tar.zst"},{"name":"tidalt-3.5.0-1.fc43.aarch64.rpm","size":3476615,"download_count":9,"release_tag":"v3.5.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.5.0/tidalt-3.5.0-1.fc43.aarch64.rpm"},{"name":"tidalt-3.5.0-1.fc43.x86_64.rpm","size":3887509,"download_count":9,"release_tag":"v3.5.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.5.0/tidalt-3.5.0-1.fc43.x86_64.rpm"},{"name":"tidalt-debug-3.5.0-1-x86_64.pkg.tar.zst","size":3961742,"download_count":2,"release_tag":"v3.5.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.5.0/tidalt-debug-3.5.0-1-x86_64.pkg.tar.zst"},{"name":"tidalt-linux-amd64","size":11505256,"download_count":3,"release_tag":"v3.5.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.5.0/tidalt-linux-amd64"},{"name":"tidalt-linux-arm64","size":10567216,"download_count":2,"release_tag":"v3.5.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.5.0/tidalt-linux-arm64"},{"name":"tidalt_3.5.0-1_amd64.deb","size":3535376,"download_count":2,"release_tag":"v3.5.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.5.0/tidalt_3.5.0-1_amd64.deb"},{"name":"tidalt_3.5.0-1_arm64.deb","size":3015056,"download_count":2,"release_tag":"v3.5.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.5.0/tidalt_3.5.0-1_arm64.deb"},{"name":"checksums.txt","size":753,"download_count":0,"release_tag":"v3.4.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.4.1/checksums.txt"},{"name":"tidalt-3.4.1-1-x86_64.pkg.tar.zst","size":4476708,"download_count":0,"release_tag":"v3.4.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.4.1/tidalt-3.4.1-1-x86_64.pkg.tar.zst"},{"name":"tidalt-3.4.1-1.fc43.aarch64.rpm","size":3477012,"download_count":0,"release_tag":"v3.4.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.4.1/tidalt-3.4.1-1.fc43.aarch64.rpm"},{"name":"tidalt-3.4.1-1.fc43.x86_64.rpm","size":3887695,"download_count":0,"release_tag":"v3.4.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.4.1/tidalt-3.4.1-1.fc43.x86_64.rpm"},{"name":"tidalt-debug-3.4.1-1-x86_64.pkg.tar.zst","size":3961692,"download_count":0,"release_tag":"v3.4.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.4.1/tidalt-debug-3.4.1-1-x86_64.pkg.tar.zst"},{"name":"tidalt-linux-amd64","size":11505256,"download_count":0,"release_tag":"v3.4.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.4.1/tidalt-linux-amd64"},{"name":"tidalt-linux-arm64","size":10567216,"download_count":0,"release_tag":"v3.4.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.4.1/tidalt-linux-arm64"},{"name":"tidalt_3.4.1-1_amd64.deb","size":3533816,"download_count":0,"release_tag":"v3.4.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.4.1/tidalt_3.4.1-1_amd64.deb"},{"name":"tidalt_3.4.1-1_arm64.deb","size":3017392,"download_count":0,"release_tag":"v3.4.1","url":"https://github.com/Benehiko/tidalt/releases/download/v3.4.1/tidalt_3.4.1-1_arm64.deb"},{"name":"tidalt-linux-amd64","size":11380904,"download_count":0,"release_tag":"v3.0.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.0.0/tidalt-linux-amd64"},{"name":"tidalt-linux-arm64","size":10500208,"download_count":1,"release_tag":"v3.0.0","url":"https://github.com/Benehiko/tidalt/releases/download/v3.0.0/tidalt-linux-arm64"}]}},"commit_sha":"fd1978e8263f64b0bc3b7fee3abf5692860eddeb","profile":{"lines_by_language":{"Go":13210,"C":357,"Shell":155,"HCL":71},"files_by_category":{"vendored":1056,"source":43,"docs":17,"other":15,"test":8,"config":7,"binary":1,"generated":1},"source_lines":12044,"test_lines":1749},"pillars":{"ai_provenance":{"score":56.5,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.5653,"suspected_share":0.2268,"estimated_share":0.5653,"ai_artifacts":3.0,"flagged_work_units":2.0,"flagged_releases":0.0,"style_index":0.0},"summary":"Explicit AI attribution on 57% of first-party code added; an estimated 57% including velocity signals."},"quality":{"score":74.8,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":63.6,"duplication":73.3,"lint":86.5,"testing":81.4,"docs":65.0,"type_safety":null,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.15, CI runs tests; 15% of function code in complex or long functions; 5% duplicated lines. Weakest area: complexity."},"security":{"score":59.3,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":93.6,"sast":78.7,"dependencies":60.7,"ci_actions":0.6,"posture":20.0,"scorecard":null},"summary":"Security posture is weak: 30 known vulnerabilities in 5 dependencies; 3 high-severity SAST findings; 26 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":141.0,"attributed_commits":55.0,"attributed_commit_share":0.3900709219858156,"effective_loc":17546.0,"attributed_loc":9918.0,"attributed_loc_share":0.5652570386412857,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 55 attributed commits, 9,918 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"fd1978e8263f64b0bc3b7fee3abf5692860eddeb","url":"https://github.com/Benehiko/tidalt/commit/fd1978e8263f64b0bc3b7fee3abf5692860eddeb","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"b83167db532c11395b2c0d110663e6c7a9b65f0d","url":"https://github.com/Benehiko/tidalt/commit/b83167db532c11395b2c0d110663e6c7a9b65f0d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a06a0b32cc8ca75c3b6ba5cf36f284b36a293c7e","url":"https://github.com/Benehiko/tidalt/commit/a06a0b32cc8ca75c3b6ba5cf36f284b36a293c7e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"e253b757a2104618c3ad25c6bb31631670a7d119","url":"https://github.com/Benehiko/tidalt/commit/e253b757a2104618c3ad25c6bb31631670a7d119","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"6cf18c99f8078c506a49a6cc3f48561e97548dc2","url":"https://github.com/Benehiko/tidalt/commit/6cf18c99f8078c506a49a6cc3f48561e97548dc2","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1d3151ffad629e66f41be6018ce00589a347045e","url":"https://github.com/Benehiko/tidalt/commit/1d3151ffad629e66f41be6018ce00589a347045e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"4cc038d0b812636b92e670523dd73bc53c2d9d0d","url":"https://github.com/Benehiko/tidalt/commit/4cc038d0b812636b92e670523dd73bc53c2d9d0d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"17dd268bc7cadaf6d8b5a5f822db5c6d25589d09","url":"https://github.com/Benehiko/tidalt/commit/17dd268bc7cadaf6d8b5a5f822db5c6d25589d09","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1eaaf459cb9412bda3d0e2d4e74cbd9683a50512","url":"https://github.com/Benehiko/tidalt/commit/1eaaf459cb9412bda3d0e2d4e74cbd9683a50512","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f93fa3892ed950eebbc966ba0566111ae7387bad","url":"https://github.com/Benehiko/tidalt/commit/f93fa3892ed950eebbc966ba0566111ae7387bad","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"bbb6968819fa4b81cafef8d4386c74d14fd3c8fb","url":"https://github.com/Benehiko/tidalt/commit/bbb6968819fa4b81cafef8d4386c74d14fd3c8fb","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"5e1e89c22ea935b4c50d7d91a6e7119e0a07366d","url":"https://github.com/Benehiko/tidalt/commit/5e1e89c22ea935b4c50d7d91a6e7119e0a07366d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"70b4b889ca6a965eadc21d163882dc23fa30a23a","url":"https://github.com/Benehiko/tidalt/commit/70b4b889ca6a965eadc21d163882dc23fa30a23a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"eda1bccd4f6ca94d8e194459ea226ba6f899c0cb","url":"https://github.com/Benehiko/tidalt/commit/eda1bccd4f6ca94d8e194459ea226ba6f899c0cb","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3db6c6fa1a73283b53af70939bbe936cdb042e45","url":"https://github.com/Benehiko/tidalt/commit/3db6c6fa1a73283b53af70939bbe936cdb042e45","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"5bbfcb3f4e2db72fcea66b47ac54d0ff9d114632","url":"https://github.com/Benehiko/tidalt/commit/5bbfcb3f4e2db72fcea66b47ac54d0ff9d114632","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3b6d6eaf091d4495947d14c06a605b08fc60056a","url":"https://github.com/Benehiko/tidalt/commit/3b6d6eaf091d4495947d14c06a605b08fc60056a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"59c610d047666d6cbf452b7c5fc278bb8b642b6f","url":"https://github.com/Benehiko/tidalt/commit/59c610d047666d6cbf452b7c5fc278bb8b642b6f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"aa12fa5d5cf000a646eeb684996906ce85ff937d","url":"https://github.com/Benehiko/tidalt/commit/aa12fa5d5cf000a646eeb684996906ce85ff937d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"41e5ac7814c8a75e8542bd9f0c71e93af55942d5","url":"https://github.com/Benehiko/tidalt/commit/41e5ac7814c8a75e8542bd9f0c71e93af55942d5","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"12e284e7d8141cf8084759e54842d54b366021b0","url":"https://github.com/Benehiko/tidalt/commit/12e284e7d8141cf8084759e54842d54b366021b0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7d9ba69f6fca2f250e2c865b2c9defb15273c0fd","url":"https://github.com/Benehiko/tidalt/commit/7d9ba69f6fca2f250e2c865b2c9defb15273c0fd","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1ddc111904ebec2bc34fad0ccaf054f2a0f18634","url":"https://github.com/Benehiko/tidalt/commit/1ddc111904ebec2bc34fad0ccaf054f2a0f18634","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"65285f1643e9749005be04e480974cd19f9ea682","url":"https://github.com/Benehiko/tidalt/commit/65285f1643e9749005be04e480974cd19f9ea682","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"8bbccfd62f8e4e98c2f410b8146c1049cbcc7b2b","url":"https://github.com/Benehiko/tidalt/commit/8bbccfd62f8e4e98c2f410b8146c1049cbcc7b2b","weight":0.9}],"data":{"attributed_loc_by_commit":{"3669750f3139bbcf390a0439c2c0c350e482af38":15,"efbf52786e1c868fe9ab33caf90f8705b4019f8c":33,"2c94bbdca69a2f44f13716f0201b7967799a0ad5":35,"2afa9774349d259d88a6a857cc26b0f2275c1e44":32,"0a5a6df34eae62f11f1f55d45536314d2527043e":25,"f1e1bff6796ed3d1b376e0d687c730b31d8d1918":7,"0573cdad2cb7ac4dbc56e2250db5ccc563801a82":14,"f6b90be6a59e8fe9dff6361b963a2df4ec6381f5":33,"86d4dc9cfdefd0b0c5aa63b465e78cac03875256":11,"ea52bf9db2fa917363ebeb028ab0d8617da299a7":39,"fac01ca57c120a829c534aa7adfb1b297e8e6fae":20,"9a075a260248f0678e580f3fd9c68dd4d0faa7fe":375,"913787cd17edb5b012d031b2941d6f55019c2a48":29,"78f841f15d4956dc1398b082df7a2ce57e00704d":5,"dd4e7b11891532a376bd25503faab0638493f5fe":3,"c3a59c372fb84ab1c2f14fc5d6ee7bdddbfa198b":8,"34af1f4fbf8681515f38c68d3f6bf79f0a796131":37,"221c65631667d4dfb535bedff59d8b8c759107c1":723,"c668e7438bfe705d09bca29a0b8b51ed6f047a86":2382,"b73e4b8d413e8e822866ab7c43ad1a31e2a45dad":258,"07c57e174645890c2776a19b8cd32aae215f3138":223,"1dc0f4bedaffb3f91fcf6a4f4629bf052c12adfa":536,"34ccaf0c83345414207b133fc29d1125acf552e0":489,"6a8da56cb2ddcfb2e0565e4158bb69ae85a1a46f":281,"6876b42e32be98aff4c65f45decd6ceaa5decf77":287,"1ad19a3a4066681337b9266b048852d9e4608e96":195,"34114ef11d263eded087d7ef05fcfe9da9d542ba":62,"5683bc3640d507639d262b86b6f6f0b61c92fbd9":49,"d3827b787d13e365897b995230c3b286f32a6dcf":151,"64d3695cefd955728727c45a6e3c616da3ee1c70":32,"8bbccfd62f8e4e98c2f410b8146c1049cbcc7b2b":80,"65285f1643e9749005be04e480974cd19f9ea682":186,"1ddc111904ebec2bc34fad0ccaf054f2a0f18634":18,"7d9ba69f6fca2f250e2c865b2c9defb15273c0fd":89,"12e284e7d8141cf8084759e54842d54b366021b0":137,"41e5ac7814c8a75e8542bd9f0c71e93af55942d5":29,"aa12fa5d5cf000a646eeb684996906ce85ff937d":23,"59c610d047666d6cbf452b7c5fc278bb8b642b6f":87,"3b6d6eaf091d4495947d14c06a605b08fc60056a":125,"5bbfcb3f4e2db72fcea66b47ac54d0ff9d114632":0,"3db6c6fa1a73283b53af70939bbe936cdb042e45":0,"eda1bccd4f6ca94d8e194459ea226ba6f899c0cb":7,"70b4b889ca6a965eadc21d163882dc23fa30a23a":756,"5e1e89c22ea935b4c50d7d91a6e7119e0a07366d":0,"bbb6968819fa4b81cafef8d4386c74d14fd3c8fb":0,"f93fa3892ed950eebbc966ba0566111ae7387bad":356,"1eaaf459cb9412bda3d0e2d4e74cbd9683a50512":373,"17dd268bc7cadaf6d8b5a5f822db5c6d25589d09":449,"4cc038d0b812636b92e670523dd73bc53c2d9d0d":0,"1d3151ffad629e66f41be6018ce00589a347045e":441,"6cf18c99f8078c506a49a6cc3f48561e97548dc2":9,"e253b757a2104618c3ad25c6bb31631670a7d119":228,"a06a0b32cc8ca75c3b6ba5cf36f284b36a293c7e":0,"b83167db532c11395b2c0d110663e6c7a9b65f0d":37,"fd1978e8263f64b0bc3b7fee3abf5692860eddeb":99},"tools":{"claude-code":{"name":"Claude Code","commits":55,"loc":9918,"first_seen":1774512110,"last_seen":1789477086}},"monthly":{"2026-03":{"loc":7711,"attributed_loc":83},"2026-05":{"loc":638,"attributed_loc":638},"2026-06":{"loc":7205,"attributed_loc":7205},"2026-08":{"loc":1619,"attributed_loc":1619},"2026-09":{"loc":373,"attributed_loc":373}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":3.0,"workflow_agents":0.0,"tools_configured":3.0,"earliest_adoption":1773407539.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"vendor/github.com/clipperhouse/displaywidth/AGENTS.md (generic-agent configuration)","ref":"vendor/github.com/clipperhouse/displaywidth/AGENTS.md","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/vendor/github.com/clipperhouse/displaywidth/AGENTS.md","weight":0.5},{"kind":"ai-artifact","description":"GEMINI.md (gemini configuration)","ref":"GEMINI.md","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/GEMINI.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1773493707},{"tool":"generic-agent","path":"vendor/github.com/clipperhouse/displaywidth/AGENTS.md","added_at":1773407539},{"tool":"gemini","path":"GEMINI.md","added_at":1773493616}],"workflows":[],"tools":["claude-code","gemini","generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":30.0,"flagged_units":2.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":17546.0,"flagged_loc":7379.0,"flagged_loc_share":0.4205516926934914,"max_loc_per_hour":1313.0593411310226,"median_loc_per_hour":101.79148580307921,"pr_timed_units":11.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"3,399 lines of first-party code in ~2.6h (1,313 lines/hour, 4 commit session)","ref":"1dc0f4bedaffb3f91fcf6a4f4629bf052c12adfa","url":"https://github.com/Benehiko/tidalt/commit/1dc0f4bedaffb3f91fcf6a4f4629bf052c12adfa","weight":0.39391780233930673},{"kind":"velocity-burst","description":"3,980 lines of first-party code in ~7.8h (512 lines/hour, 38 commit session)","ref":"9660ad153a8fe3ffe3b763eca72d7326a349c6cf","url":"https://github.com/Benehiko/tidalt/commit/9660ad153a8fe3ffe3b763eca72d7326a349c6cf","weight":0.15370641873770788}],"data":{"flagged_loc_by_commit":{"e51951f93ff9bf96132a3f6dee0d8f2b0078df77":87,"1d3faed18bf91f2b03e799d18369570db4c6b150":1,"e925071f5c946e34d699f214bd9ac73cee9ef8e8":3,"ad5655d7d90ff0c5bd5324218961078ba6b8cf79":195,"31c3539712a1d1aaaa0e28e4e6993960af8d94fd":44,"2f02650994731dfdab3eea4427dec5965945e635":480,"40bf41e46e4b5603f5810dd3c437e07324f07bf8":173,"589f0b1b069a9a0ef06a931f58efa9859c29b5f8":58,"eee366533f1ca7eba8b71ecd544d8cdf531eeb85":46,"3bace908c55acda2ae809d017446f5a464998f49":295,"72f257af591ab2201fa5ed1829a89e116cf9eb80":112,"f65b950f72b47f1c717ba215b23306c7b0c77a7c":42,"e333599474c1d746ebed7a2501749121617641d2":107,"7b737ef40d303bc83ea3528f2e1543495b6926c9":57,"2c61787efefd5425b1f438ef047d38db34f5d1b3":33,"8057b7c0bf5b963abb1d6a2effdfb2fc87671334":184,"f0e00a66f4c64c8b45815749b9cfb2d5bfc96260":16,"e34af89df5cf681495699ccd094dee39380283a1":291,"419bf97f07f1ecec8a75af68abf2039a21f072aa":21,"c914a5d4bf9c2355187a61fe8cb344540448bc83":396,"0ab2897a391d7c4496178c468cd8da635f732348":120,"a8b5e7e1f38dcab2d844485948857b0d34b0448c":107,"63deeec98e93727ed7986dbaff0d7db3b9b4eff9":1,"6a431ca3d534a146dfdf1f4371e4fef1935d843e":35,"843b024c222a967f689d791ea09732d4a3fddee9":113,"8e9c7dae3692cb1f261d4f788a81bcc04e8c02f0":47,"4c4c6ac0025921b5d4f15e850a2e087251dbaf6a":35,"fe1131a32314a4d6123add79a74620f1fd8c2907":24,"552ea127ece04f1baa221015a742a51180116bb3":59,"f904af2d0fd7697435e19a415da02eb7e5c8bf97":35,"c3051ae3940342d50c224c306d43d64754338bec":65,"8ee1989b2c0953a37cd4811361f9628b1ecba6ab":42,"0bba9c899b3761bd4e6b10d9dcad8c02df3cccac":227,"d4b4a8b8d90225c7d0137a786f47ce1011a5e28d":2,"2d127c45ddc0a4cc2233e2ee66cb6e70c1687acd":52,"6123d0f13973a34e18ca2cd3b23714417ba7d470":236,"c7d5e2d18125e23f36badabfcc6064e4931f3334":111,"9660ad153a8fe3ffe3b763eca72d7326a349c6cf":28,"c668e7438bfe705d09bca29a0b8b51ed6f047a86":2382,"b73e4b8d413e8e822866ab7c43ad1a31e2a45dad":258,"07c57e174645890c2776a19b8cd32aae215f3138":223,"1dc0f4bedaffb3f91fcf6a4f4629bf052c12adfa":536},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":17.0,"flagged_releases":0.0,"max_loc_per_day":18116.5},"findings":[],"evidence":[],"data":{"releases":[{"from":"v1.0.0","to":"v2.0.0","loc":2467,"days":0.4,"loc_per_day":6092.8,"flagged":false},{"from":"v2.0.0","to":"v2.1.0","loc":875,"days":0.05,"loc_per_day":18116.5,"flagged":false},{"from":"v2.1.0","to":"v2.2.0","loc":506,"days":0.04,"loc_per_day":12144.0,"flagged":false},{"from":"v2.2.0","to":"v3.0.0","loc":375,"days":0.04,"loc_per_day":9000.0,"flagged":false},{"from":"v3.0.0","to":"v3.1.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v3.1.0","to":"v3.2.0","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v3.2.0","to":"v3.3.0","loc":50,"days":0.04,"loc_per_day":1200.0,"flagged":false},{"from":"v3.3.0","to":"v3.4.0","loc":416,"days":0.04,"loc_per_day":9984.0,"flagged":false},{"from":"v3.4.0","to":"v3.4.1","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v3.4.1","to":"v3.5.0","loc":10,"days":0.04,"loc_per_day":240.0,"flagged":false},{"from":"v3.5.0","to":"v3.5.1","loc":535,"days":0.04,"loc_per_day":12840.0,"flagged":false},{"from":"v3.5.1","to":"v3.6.0","loc":39,"days":0.41,"loc_per_day":95.8,"flagged":false},{"from":"v3.6.0","to":"v3.6.1","loc":21,"days":0.04,"loc_per_day":504.0,"flagged":false},{"from":"v3.6.1","to":"v4.0.0","loc":7741,"days":81.72,"loc_per_day":94.7,"flagged":false},{"from":"v4.0.0","to":"v4.0.1","loc":756,"days":4.03,"loc_per_day":187.8,"flagged":false},{"from":"v4.0.1","to":"v4.0.2","loc":1178,"days":59.45,"loc_per_day":19.8,"flagged":false},{"from":"v4.0.2","to":"v4.0.3","loc":678,"days":32.88,"loc_per_day":20.6,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":12044.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":2.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"internal/tidal/client.go","line":22,"fingerprint":"internal/tidal/client.go:generic-api-key:22"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"vendor/filippo.io/age/README.md","line":19,"fingerprint":"vendor/filippo.io/age/README.md:generic-api-key:19"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":17.0,"findings_high":3.0,"findings_medium":14.0,"findings_low":0.0,"weighted_findings":8.25,"scanned_lines":12044.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"cmd/tidalt/play.go","line":82,"fingerprint":"go.lang.security.audit.dangerous-exec-command:cmd/tidalt/play.go:82"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"cmd/tidalt/setup.go","line":71,"fingerprint":"go.lang.security.audit.dangerous-exec-command:cmd/tidalt/setup.go:71"},{"rule_id":"opengrep/dockerfile.security.missing-user-entrypoint","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"packaging/docker/Dockerfile","line":59,"fingerprint":"dockerfile.security.missing-user-entrypoint:packaging/docker/Dockerfile:59"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"cmd/tidalt/daemon.go","line":8,"fingerprint":"go.lang.security.audit.xss.import-text-template:cmd/tidalt/daemon.go:8"},{"rule_id":"opengrep/c.lang.security.insecure-use-memset","severity":"medium","message":"When handling sensitive information in a buffer, it's important to ensure  that the data is securely erased before the buffer is deleted or reused.  While `memset()` is commonly used for this purpose, it can leave sensitive  information behind due to compiler optimizations or other factors.  To avoi [confidence low]","path":"internal/player/avcodec.c","line":13,"fingerprint":"c.lang.security.insecure-use-memset:internal/player/avcodec.c:13"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"internal/player/avcodec.go","line":80,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:internal/player/avcodec.go:80"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"internal/player/avcodec.go","line":80,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:internal/player/avcodec.go:80"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"internal/player/avcodec.go","line":106,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:internal/player/avcodec.go:106"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"internal/player/avcodec.go","line":128,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:internal/player/avcodec.go:128"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"internal/player/avcodec.go","line":128,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:internal/player/avcodec.go:128"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"internal/player/avcodec.go","line":130,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:internal/player/avcodec.go:130"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"internal/player/avcodec.go","line":144,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:internal/player/avcodec.go:144"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"internal/player/mpv.go","line":478,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:internal/player/mpv.go:478"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"internal/player/mpv.go","line":1012,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:internal/player/mpv.go:1012"},{"rule_id":"opengrep/go.lang.security.audit.crypto.math-random-used","severity":"medium","message":"Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium]","path":"internal/ui/components.go","line":5,"fingerprint":"go.lang.security.audit.crypto.math-random-used:internal/ui/components.go:5"},{"rule_id":"opengrep/go.lang.security.audit.crypto.math-random-used","severity":"medium","message":"Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium]","path":"internal/ui/model.go","line":9,"fingerprint":"go.lang.security.audit.crypto.math-random-used:internal/ui/model.go:9"},{"rule_id":"opengrep/dockerfile.security.no-sudo-in-dockerfile","severity":"medium","message":"Avoid using sudo in Dockerfiles. Running processes as a non-root user can help  reduce the potential impact of configuration errors and security vulnerabilities. [confidence high]","path":"packaging/arch/Dockerfile","line":21,"fingerprint":"dockerfile.security.no-sudo-in-dockerfile:packaging/arch/Dockerfile:21"}],"evidence":[],"data":{"rulesets":["go","c","bash","terraform","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":5.0,"vulnerabilities":30.0,"vulns_critical":7.0,"vulns_high":3.0,"vulns_medium":5.0,"vulns_low":1.0,"vulns_unknown":14.0,"penalty":30.0},"findings":[{"rule_id":"osv/GHSA-jppx-rxg9-jmrx","severity":"critical","message":"golang.org/x/crypto@0.47.0 (Go) is affected by GO-2026-5005, GHSA-jppx-rxg9-jmrx","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.47.0 (Go):GHSA-jppx-rxg9-jmrx"},{"rule_id":"osv/GHSA-f5wc-c3c7-36mc","severity":"critical","message":"golang.org/x/crypto@0.47.0 (Go) is affected by GO-2026-5006, GHSA-f5wc-c3c7-36mc","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.47.0 (Go):GHSA-f5wc-c3c7-36mc"},{"rule_id":"osv/GHSA-vgwf-h737-ff37","severity":"critical","message":"golang.org/x/crypto@0.47.0 (Go) is affected by GO-2026-5017, GHSA-vgwf-h737-ff37","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.47.0 (Go):GHSA-vgwf-h737-ff37"},{"rule_id":"osv/GHSA-89gr-r52h-f8rx","severity":"critical","message":"golang.org/x/crypto@0.47.0 (Go) is affected by GO-2026-5019, GHSA-89gr-r52h-f8rx","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.47.0 (Go):GHSA-89gr-r52h-f8rx"},{"rule_id":"osv/GHSA-rm3j-f69w-wqmq","severity":"critical","message":"golang.org/x/crypto@0.47.0 (Go) is affected by GO-2026-5020, GHSA-rm3j-f69w-wqmq","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.47.0 (Go):GHSA-rm3j-f69w-wqmq"},{"rule_id":"osv/GHSA-5cgq-3rg8-m6cv","severity":"critical","message":"golang.org/x/crypto@0.47.0 (Go) is affected by GO-2026-5021, GHSA-5cgq-3rg8-m6cv","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.47.0 (Go):GHSA-5cgq-3rg8-m6cv"},{"rule_id":"osv/GHSA-x527-x647-q7gg","severity":"critical","message":"golang.org/x/crypto@0.47.0 (Go) is affected by GO-2026-5023, GHSA-x527-x647-q7gg","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.47.0 (Go):GHSA-x527-x647-q7gg"},{"rule_id":"osv/GHSA-q4h4-gmj2-qvw2","severity":"high","message":"golang.org/x/crypto@0.47.0 (Go) is affected by GO-2026-5013, GHSA-q4h4-gmj2-qvw2","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.47.0 (Go):GHSA-q4h4-gmj2-qvw2"},{"rule_id":"osv/GHSA-w879-237q-wc7r","severity":"high","message":"golang.org/x/crypto@0.47.0 (Go) is affected by GO-2026-5018, GHSA-w879-237q-wc7r","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.47.0 (Go):GHSA-w879-237q-wc7r"},{"rule_id":"osv/GHSA-q675-qj96-32m9","severity":"high","message":"golang.org/x/image@0.37.0 (Go) is affected by GO-2026-5032, GHSA-q675-qj96-32m9","path":"go.mod","line":null,"fingerprint":"golang.org/x/image@0.37.0 (Go):GHSA-q675-qj96-32m9"},{"rule_id":"osv/GHSA-45gg-vh54-h5m9","severity":"medium","message":"golang.org/x/crypto@0.47.0 (Go) is affected by GO-2026-5014, GHSA-45gg-vh54-h5m9","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.47.0 (Go):GHSA-45gg-vh54-h5m9"},{"rule_id":"osv/GHSA-78mq-xcr3-xm33","severity":"medium","message":"golang.org/x/crypto@0.47.0 (Go) is affected by GO-2026-5015, GHSA-78mq-xcr3-xm33","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.47.0 (Go):GHSA-78mq-xcr3-xm33"},{"rule_id":"osv/GHSA-qpw4-5x99-6vjp","severity":"medium","message":"golang.org/x/crypto@0.47.0 (Go) is affected by GO-2026-5016, GHSA-qpw4-5x99-6vjp","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.47.0 (Go):GHSA-qpw4-5x99-6vjp"},{"rule_id":"osv/GHSA-9m57-25v3-79x9","severity":"medium","message":"golang.org/x/crypto@0.47.0 (Go) is affected by GO-2026-5033, GHSA-9m57-25v3-79x9","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.47.0 (Go):GHSA-9m57-25v3-79x9"},{"rule_id":"osv/GO-2026-5932","severity":"medium","message":"golang.org/x/crypto@0.47.0 (Go) is affected by GO-2026-5932","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.47.0 (Go):GO-2026-5932"},{"rule_id":"osv/GO-2026-6303","severity":"medium","message":"golang.org/x/crypto@0.47.0 (Go) is affected by GO-2026-6303","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.47.0 (Go):GO-2026-6303"},{"rule_id":"osv/GO-2026-6354","severity":"medium","message":"golang.org/x/crypto@0.47.0 (Go) is affected by GO-2026-6354","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.47.0 (Go):GO-2026-6354"},{"rule_id":"osv/GO-2026-6355","severity":"medium","message":"golang.org/x/crypto@0.47.0 (Go) is affected by GO-2026-6355","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.47.0 (Go):GO-2026-6355"},{"rule_id":"osv/GHSA-44p7-9xx4-hf2g","severity":"medium","message":"golang.org/x/image@0.37.0 (Go) is affected by GO-2026-4815, GHSA-44p7-9xx4-hf2g","path":"go.mod","line":null,"fingerprint":"golang.org/x/image@0.37.0 (Go):GHSA-44p7-9xx4-hf2g"},{"rule_id":"osv/GO-2026-4961","severity":"medium","message":"golang.org/x/image@0.37.0 (Go) is affected by GO-2026-4961","path":"go.mod","line":null,"fingerprint":"golang.org/x/image@0.37.0 (Go):GO-2026-4961"},{"rule_id":"osv/GO-2026-4962","severity":"medium","message":"golang.org/x/image@0.37.0 (Go) is affected by GO-2026-4962","path":"go.mod","line":null,"fingerprint":"golang.org/x/image@0.37.0 (Go):GO-2026-4962"},{"rule_id":"osv/GO-2026-5031","severity":"medium","message":"golang.org/x/image@0.37.0 (Go) is affected by GO-2026-5031","path":"go.mod","line":null,"fingerprint":"golang.org/x/image@0.37.0 (Go):GO-2026-5031"},{"rule_id":"osv/GO-2026-5061","severity":"medium","message":"golang.org/x/image@0.37.0 (Go) is affected by GO-2026-5061","path":"go.mod","line":null,"fingerprint":"golang.org/x/image@0.37.0 (Go):GO-2026-5061"},{"rule_id":"osv/GO-2026-5062","severity":"medium","message":"golang.org/x/image@0.37.0 (Go) is affected by GO-2026-5062","path":"go.mod","line":null,"fingerprint":"golang.org/x/image@0.37.0 (Go):GO-2026-5062"},{"rule_id":"osv/GO-2026-5066","severity":"medium","message":"golang.org/x/image@0.37.0 (Go) is affected by GO-2026-5066","path":"go.mod","line":null,"fingerprint":"golang.org/x/image@0.37.0 (Go):GO-2026-5066"},{"rule_id":"osv/GO-2026-6222","severity":"medium","message":"golang.org/x/image@0.37.0 (Go) is affected by GO-2026-6222","path":"go.mod","line":null,"fingerprint":"golang.org/x/image@0.37.0 (Go):GO-2026-6222"},{"rule_id":"osv/GO-2026-5024","severity":"medium","message":"golang.org/x/sys@0.40.0 (Go) is affected by GO-2026-5024","path":"go.mod","line":null,"fingerprint":"golang.org/x/sys@0.40.0 (Go):GO-2026-5024"},{"rule_id":"osv/GO-2026-5970","severity":"medium","message":"golang.org/x/text@0.35.0 (Go) is affected by GO-2026-5970","path":"go.mod","line":null,"fingerprint":"golang.org/x/text@0.35.0 (Go):GO-2026-5970"},{"rule_id":"osv/GO-2026-6629","severity":"medium","message":"golang.org/x/text@0.35.0 (Go) is affected by GO-2026-6629","path":"go.mod","line":null,"fingerprint":"golang.org/x/text@0.35.0 (Go):GO-2026-6629"},{"rule_id":"osv/GHSA-fw7p-63qq-7hpr","severity":"low","message":"filippo.io/edwards25519@1.1.0 (Go) is affected by GO-2026-4503, GHSA-fw7p-63qq-7hpr","path":"go.mod","line":null,"fingerprint":"filippo.io/edwards25519@1.1.0 (Go):GHSA-fw7p-63qq-7hpr"}],"evidence":[],"data":{"ecosystems":["Go"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":3.0,"findings":34.0,"findings_high":26.0,"findings_medium":7.0,"findings_low":1.0,"penalty":312.0},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":17,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:17"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":20,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:20"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":30,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:30"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":33,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:33"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/lint.yml","line":17,"fingerprint":"unpinned-uses:.github/workflows/lint.yml:17"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/lint.yml","line":20,"fingerprint":"unpinned-uses:.github/workflows/lint.yml:20"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/lint.yml","line":24,"fingerprint":"unpinned-uses:.github/workflows/lint.yml:24"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/lint.yml","line":35,"fingerprint":"unpinned-uses:.github/workflows/lint.yml:35"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/release.yml","line":9,"fingerprint":"excessive-permissions:.github/workflows/release.yml:9"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/release.yml","line":43,"fingerprint":"template-injection:.github/workflows/release.yml:43"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/workflows/release.yml","line":138,"fingerprint":"template-injection:.github/workflows/release.yml:138"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":25,"fingerprint":"unpinned-uses:.github/workflows/release.yml:25"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":27,"fingerprint":"unpinned-uses:.github/workflows/release.yml:27"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":45,"fingerprint":"unpinned-uses:.github/workflows/release.yml:45"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":56,"fingerprint":"unpinned-uses:.github/workflows/release.yml:56"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":59,"fingerprint":"unpinned-uses:.github/workflows/release.yml:59"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":62,"fingerprint":"unpinned-uses:.github/workflows/release.yml:62"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":65,"fingerprint":"unpinned-uses:.github/workflows/release.yml:65"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":84,"fingerprint":"unpinned-uses:.github/workflows/release.yml:84"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":87,"fingerprint":"unpinned-uses:.github/workflows/release.yml:87"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":90,"fingerprint":"unpinned-uses:.github/workflows/release.yml:90"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":93,"fingerprint":"unpinned-uses:.github/workflows/release.yml:93"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":109,"fingerprint":"unpinned-uses:.github/workflows/release.yml:109"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":121,"fingerprint":"unpinned-uses:.github/workflows/release.yml:121"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":164,"fingerprint":"unpinned-uses:.github/workflows/release.yml:164"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":27,"fingerprint":"cache-poisoning:.github/workflows/release.yml:27"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":17,"fingerprint":"artipacked:.github/workflows/ci.yml:17"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":30,"fingerprint":"artipacked:.github/workflows/ci.yml:30"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/lint.yml","line":17,"fingerprint":"artipacked:.github/workflows/lint.yml:17"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/lint.yml","line":35,"fingerprint":"artipacked:.github/workflows/lint.yml:35"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":25,"fingerprint":"artipacked:.github/workflows/release.yml:25"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":56,"fingerprint":"artipacked:.github/workflows/release.yml:56"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":84,"fingerprint":"artipacked:.github/workflows/release.yml:84"},{"rule_id":"zizmor/superfluous-actions","severity":"info","message":"action functionality is already included by the runner [confidence high]","path":".github/workflows/release.yml","line":164,"fingerprint":"superfluous-actions:.github/workflows/release.yml:164"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":0.8298,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":36.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v4.0.3 ships tidalt-4.0.3-1.fc44.aarch64.rpm (4 downloads)","ref":"tidalt-4.0.3-1.fc44.aarch64.rpm","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.3/tidalt-4.0.3-1.fc44.aarch64.rpm","weight":0.0},{"kind":"binary-release-asset","description":"release v4.0.3 ships tidalt-4.0.3-1.fc44.x86_64.rpm (10 downloads)","ref":"tidalt-4.0.3-1.fc44.x86_64.rpm","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.3/tidalt-4.0.3-1.fc44.x86_64.rpm","weight":0.0},{"kind":"binary-release-asset","description":"release v4.0.3 ships tidalt_4.0.3-1_amd64.deb (17 downloads)","ref":"tidalt_4.0.3-1_amd64.deb","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.3/tidalt_4.0.3-1_amd64.deb","weight":0.0},{"kind":"binary-release-asset","description":"release v4.0.3 ships tidalt_4.0.3-1_arm64.deb (5 downloads)","ref":"tidalt_4.0.3-1_arm64.deb","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.3/tidalt_4.0.3-1_arm64.deb","weight":0.0},{"kind":"binary-release-asset","description":"release v4.0.2 ships tidalt-4.0.2-1.fc44.aarch64.rpm (4 downloads)","ref":"tidalt-4.0.2-1.fc44.aarch64.rpm","url":"https://github.com/Benehiko/tidalt/releases/download/v4.0.2/tidalt-4.0.2-1.fc44.aarch64.rpm","weight":0.0}],"data":{"signals":["binary-release-assets"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":530.0,"function_nloc":7505.0,"mean_ccn":3.72,"p90_ccn":8.0,"complex_functions":11.0,"long_functions":3.0,"many_param_functions":0.0,"risky_nloc_share":0.1511},"findings":[],"evidence":[{"kind":"complex-function","description":"update in internal/ui/model.go: complexity 103, 432 lines","ref":"internal/ui/model.go","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/internal/ui/model.go#L902","weight":1.0},{"kind":"complex-function","description":"anonymous__6 in internal/player/mpv.go: complexity 36, 169 lines","ref":"internal/player/mpv.go","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/internal/player/mpv.go#L791","weight":0.6},{"kind":"complex-function","description":"commonKeys in internal/ui/keys.go: complexity 26, 49 lines","ref":"internal/ui/keys.go","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/internal/ui/keys.go#L362","weight":0.43333333333333335},{"kind":"complex-function","description":"playbackLoop in internal/player/mpv.go: complexity 25, 166 lines","ref":"internal/player/mpv.go","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/internal/player/mpv.go#L688","weight":0.4166666666666667},{"kind":"complex-function","description":"renderLogo in internal/ui/components.go: complexity 21, 44 lines","ref":"internal/ui/components.go","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/internal/ui/components.go#L107","weight":0.35},{"kind":"complex-function","description":"av_open in internal/player/avcodec.c: complexity 20, 62 lines","ref":"internal/player/avcodec.c","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/internal/player/avcodec.c#L12","weight":0.3333333333333333},{"kind":"complex-function","description":"updateSection in internal/ui/keys.go: complexity 18, 42 lines","ref":"internal/ui/keys.go","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/internal/ui/keys.go#L261","weight":0.3},{"kind":"complex-function","description":"configure_hw_pcm in internal/player/alsa.c: complexity 17, 72 lines","ref":"internal/player/alsa.c","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/internal/player/alsa.c#L11","weight":0.2833333333333333},{"kind":"complex-function","description":"quadrantGlyph in internal/ui/coverart.go: complexity 16, 36 lines","ref":"internal/ui/coverart.go","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/internal/ui/coverart.go#L113","weight":0.26666666666666666},{"kind":"complex-function","description":"selectedTrack in internal/ui/keys.go: complexity 16, 22 lines","ref":"internal/ui/keys.go","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/internal/ui/keys.go#L683","weight":0.26666666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":9015.0,"duplicated_lines":466.0,"duplicated_share":0.0517,"files":43.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: docker-bake.hcl:21 and docker-bake.hcl:47","ref":"docker-bake.hcl","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/docker-bake.hcl#L21","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: internal/player/mpv.go:837 and internal/player/mpv.go:854","ref":"internal/player/mpv.go","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/internal/player/mpv.go#L837","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: internal/spotify/spotify.go:21 and internal/tidal/api.go:4","ref":"internal/spotify/spotify.go","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/internal/spotify/spotify.go#L21","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: internal/store/store.go:72 and internal/store/store.go:109","ref":"internal/store/store.go","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/internal/store/store.go#L72","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: internal/tidal/api.go:6 and internal/tidal/library.go:6","ref":"internal/tidal/api.go","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/internal/tidal/api.go#L6","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: internal/tidal/api.go:218 and internal/tidal/api.go:684","ref":"internal/tidal/api.go","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/internal/tidal/api.go#L218","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: internal/tidal/loginprint.go:148 and internal/tidal/loginprint.go:157","ref":"internal/tidal/loginprint.go","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/internal/tidal/loginprint.go#L148","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: internal/ui/keys.go:476 and internal/ui/model.go:1077","ref":"internal/ui/keys.go","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/internal/ui/keys.go#L476","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: internal/ui/library_sections.go:39 and internal/ui/library_sections.go:182","ref":"internal/ui/library_sections.go","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/internal/ui/library_sections.go#L39","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: internal/ui/model.go:304 and internal/ui/model.go:359","ref":"internal/ui/model.go","url":"https://github.com/Benehiko/tidalt/blob/fd1978e8263f64b0bc3b7fee3abf5692860eddeb/internal/ui/model.go#L304","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":7.0,"weighted_findings":7.0,"scanned_lines":12044.0,"category:correctness":7.0},"findings":[{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"cmd/tidalt/daemon.go","line":79,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:cmd/tidalt/daemon.go:79"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"cmd/tidalt/play.go","line":26,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:cmd/tidalt/play.go:26"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"cmd/tidalt/setup.go","line":23,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:cmd/tidalt/setup.go:23"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/logger/logger.go","line":26,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/logger/logger.go:26"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/store/store.go","line":36,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/store/store.go:36"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/store/store.go","line":74,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/store/store.go:74"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/store/store.go","line":111,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/store/store.go:111"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.2904,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":0.9174,"test_lines":1749.0,"source_lines":12044.0,"test_ratio":0.1452,"ci_files":3.0,"cochange_share":0.2294,"cochange_commits":109.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/lint.yml","ref":".github/workflows/lint.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (go test)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (golangci-lint)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["go test"],"lint_commands":["golangci-lint"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":165.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":7629.0,"other_lines":4415.0,"files_blamed":43.0,"blame_failures":0.0,"quality:ai_findings":2.0,"quality:ai_per_kloc":0.262,"quality:other_findings":5.0,"quality:other_per_kloc":1.133,"quality:ratio":0.23,"security:ai_findings":12.0,"security:ai_per_kloc":1.573,"security:other_findings":4.0,"security:other_per_kloc":0.906,"security:ratio":1.74},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}