{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:57:28.374566Z","repo":{"ref":{"host":"github.com","owner":"Brostoffed","name":"writemark"},"default_branch":"main","clone_url":"https://github.com/Brostoffed/writemark.git","html_url":"https://github.com/Brostoffed/writemark","description":null,"stars":72,"forks":2,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":7237,"primary_language":"JavaScript","license_spdx":"MIT","created_at":"2026-06-26T17:36:32Z","pushed_at":"2026-10-24T03:43:46Z","security_policy_url":null,"distribution":{"owner_created_at":"2022-12-09T05:09:07Z","owner_type":"User","release_assets":[{"name":"manifest.json","size":6184,"download_count":2,"release_tag":"v1.8.1","url":"https://github.com/Brostoffed/writemark/releases/download/v1.8.1/manifest.json"},{"name":"writemark-editor.global.min.js","size":237232,"download_count":2,"release_tag":"v1.8.1","url":"https://github.com/Brostoffed/writemark/releases/download/v1.8.1/writemark-editor.global.min.js"},{"name":"manifest.json","size":5124,"download_count":1,"release_tag":"v1.8.0","url":"https://github.com/Brostoffed/writemark/releases/download/v1.8.0/manifest.json"},{"name":"writemark-editor.global.min.js","size":235018,"download_count":1,"release_tag":"v1.8.0","url":"https://github.com/Brostoffed/writemark/releases/download/v1.8.0/writemark-editor.global.min.js"}]}},"commit_sha":"ad67772b9dfbd2e94b0eb52628916a624ea6c995","profile":{"lines_by_language":{"JavaScript":12397,"TypeScript":7934},"files_by_category":{"source":51,"test":34,"docs":15,"config":12,"generated":11,"other":7,"oversized":1},"source_lines":9008,"test_lines":11323},"pillars":{"ai_provenance":{"score":41.5,"confidence":0.81,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.4146,"suspected_share":0.2466,"estimated_share":0.4146,"ai_artifacts":1.0,"flagged_work_units":4.0,"flagged_releases":1.0},"summary":"Explicit AI attribution on 41% of first-party code added; an estimated 41% including velocity signals."},"quality":{"score":73.4,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":38.6,"duplication":88.7,"lint":60.3,"testing":90.0,"docs":85.0,"type_safety":100.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 1.26, CI runs tests; 32% of function code in complex or long functions; 2% duplicated lines. Weakest area: complexity."},"security":{"score":56.7,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":96.7,"sast":33.0,"dependencies":100.0,"ci_actions":1.9,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 19 high-severity SAST findings; 20 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":5.0,"checked":5.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":46.0,"attributed_commits":12.0,"attributed_commit_share":0.2608695652173913,"effective_loc":29329.0,"attributed_loc":12160.0,"attributed_loc_share":0.41460670326298205,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"OpenAI Codex: 12 attributed commits, 12,160 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (ad67772b9d)","ref":"cbd3711b22bade79f5f27738e10026c536d607af","url":"https://github.com/Brostoffed/writemark/commit/cbd3711b22bade79f5f27738e10026c536d607af","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (ad67772b9d)","ref":"0f1940f64901b8251044f67b3f2ca360e669f542","url":"https://github.com/Brostoffed/writemark/commit/0f1940f64901b8251044f67b3f2ca360e669f542","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (ad67772b9d)","ref":"bd564285ca1422ca37c8a29cb703333ce5dd2708","url":"https://github.com/Brostoffed/writemark/commit/bd564285ca1422ca37c8a29cb703333ce5dd2708","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (f05a12f29c)","ref":"a4758191464432084d71a29f07c61caac65bbef4","url":"https://github.com/Brostoffed/writemark/commit/a4758191464432084d71a29f07c61caac65bbef4","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (f05a12f29c)","ref":"5611153f6f9282fb8dcaee604a6712091b8ffdea","url":"https://github.com/Brostoffed/writemark/commit/5611153f6f9282fb8dcaee604a6712091b8ffdea","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (2dc0d46c29)","ref":"0c857bcce5298df8b5d62430ac65b91ba548801d","url":"https://github.com/Brostoffed/writemark/commit/0c857bcce5298df8b5d62430ac65b91ba548801d","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (2dc0d46c29)","ref":"f6e03e73198197e816d0eab8186b5e13257949f8","url":"https://github.com/Brostoffed/writemark/commit/f6e03e73198197e816d0eab8186b5e13257949f8","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (2dc0d46c29)","ref":"9fa79cf4d8f2c1f5b9e019cd7babfb2f54e21c45","url":"https://github.com/Brostoffed/writemark/commit/9fa79cf4d8f2c1f5b9e019cd7babfb2f54e21c45","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (45af335825)","ref":"a728275f7db314c7681e1a06e4648abb85bc637f","url":"https://github.com/Brostoffed/writemark/commit/a728275f7db314c7681e1a06e4648abb85bc637f","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (45af335825)","ref":"1b61bfdf0aed4825d26d93c16f40f7a8be9a09a4","url":"https://github.com/Brostoffed/writemark/commit/1b61bfdf0aed4825d26d93c16f40f7a8be9a09a4","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (45af335825)","ref":"d0f795da3c95ad6c8ae23d503c568fd1316fd254","url":"https://github.com/Brostoffed/writemark/commit/d0f795da3c95ad6c8ae23d503c568fd1316fd254","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (45af335825)","ref":"9b8f89d9122f592170b74ea0d0567618f8463dcc","url":"https://github.com/Brostoffed/writemark/commit/9b8f89d9122f592170b74ea0d0567618f8463dcc","weight":0.9}],"data":{"attributed_loc_by_commit":{"9b8f89d9122f592170b74ea0d0567618f8463dcc":1463,"d0f795da3c95ad6c8ae23d503c568fd1316fd254":114,"1b61bfdf0aed4825d26d93c16f40f7a8be9a09a4":103,"a728275f7db314c7681e1a06e4648abb85bc637f":93,"9fa79cf4d8f2c1f5b9e019cd7babfb2f54e21c45":156,"f6e03e73198197e816d0eab8186b5e13257949f8":283,"0c857bcce5298df8b5d62430ac65b91ba548801d":20,"5611153f6f9282fb8dcaee604a6712091b8ffdea":7585,"a4758191464432084d71a29f07c61caac65bbef4":3,"bd564285ca1422ca37c8a29cb703333ce5dd2708":2266,"0f1940f64901b8251044f67b3f2ca360e669f542":0,"cbd3711b22bade79f5f27738e10026c536d607af":74},"tools":{"openai-codex":{"name":"OpenAI Codex","commits":12,"loc":12160,"first_seen":1786338275,"last_seen":1792797554}},"monthly":{"2026-06":{"loc":4467,"attributed_loc":0},"2026-07":{"loc":11471,"attributed_loc":0},"2026-08":{"loc":1994,"attributed_loc":1773},"2026-09":{"loc":459,"attributed_loc":459},"2026-10":{"loc":10938,"attributed_loc":9928}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1792796401.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/Brostoffed/writemark/blob/ad67772b9dfbd2e94b0eb52628916a624ea6c995/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"generic-agent","path":"AGENTS.md","added_at":1792796401}],"workflows":[],"tools":["generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":26.0,"flagged_units":4.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":21744.0,"flagged_loc":9572.0,"flagged_loc_share":0.44021339220014716,"max_loc_per_hour":844.0,"median_loc_per_hour":166.37146462918201,"pr_timed_units":0.0,"excluded_import_loc":7585.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"3,376 lines of first-party code in ~4.0h (844 lines/hour, 1 commit session)","ref":"27568e5d8381fc5b1e0c2b94e6d1b4f83042807c","url":"https://github.com/Brostoffed/writemark/commit/27568e5d8381fc5b1e0c2b94e6d1b4f83042807c","weight":0.2532},{"kind":"velocity-burst","description":"1,633 lines of first-party code in ~2.5h (662 lines/hour, 3 commit session)","ref":"3a8ca7e85ec1eaa94ca126e719f02a1ef1169952","url":"https://github.com/Brostoffed/writemark/commit/3a8ca7e85ec1eaa94ca126e719f02a1ef1169952","weight":0.19874239350912778},{"kind":"velocity-burst","description":"2,340 lines of first-party code in ~4.3h (542 lines/hour, 2 commit session)","ref":"cbd3711b22bade79f5f27738e10026c536d607af","url":"https://github.com/Brostoffed/writemark/commit/cbd3711b22bade79f5f27738e10026c536d607af","weight":0.1624895518549476},{"kind":"velocity-burst","description":"2,223 lines of first-party code in ~4.2h (531 lines/hour, 2 commit session)","ref":"4096683f9b60dd4a91b4a675c7aad11d99ea93de","url":"https://github.com/Brostoffed/writemark/commit/4096683f9b60dd4a91b4a675c7aad11d99ea93de","weight":0.15920689655172413}],"data":{"flagged_loc_by_commit":{"27568e5d8381fc5b1e0c2b94e6d1b4f83042807c":3376,"81b2ec31fc066bb7b5c404293daa0548c36723b8":2024,"4096683f9b60dd4a91b4a675c7aad11d99ea93de":199,"b36cfc4a0745c87ec02e3f42957fe16de9679fd3":875,"fd42a0f1d26347e087d9552b3e4fb51e9e336449":279,"3a8ca7e85ec1eaa94ca126e719f02a1ef1169952":479,"bd564285ca1422ca37c8a29cb703333ce5dd2708":2266,"cbd3711b22bade79f5f27738e10026c536d607af":74},"excluded_import_commits":["5611153f6f9282fb8dcaee604a6712091b8ffdea"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"releases":11.0,"flagged_releases":1.0,"max_loc_per_day":11402.0},"findings":[],"evidence":[{"kind":"release-burst","description":"v1.4.1 → v1.5.0: 5,523 lines in 0.83 days (6,688.8 lines/day)","ref":"v1.4.1...v1.5.0","url":"https://github.com/Brostoffed/writemark/compare/v1.4.1...v1.5.0","weight":0.4}],"data":{"releases":[{"from":"v1.3.0","to":"v1.3.1","loc":741,"days":0.06,"loc_per_day":11402.0,"flagged":false},{"from":"v1.3.1","to":"v1.4.0","loc":810,"days":1.09,"loc_per_day":743.1,"flagged":false},{"from":"v1.4.0","to":"v1.4.1","loc":17,"days":0.94,"loc_per_day":18.1,"flagged":false},{"from":"v1.4.1","to":"v1.5.0","loc":5523,"days":0.83,"loc_per_day":6688.8,"flagged":true},{"from":"v1.5.0","to":"v1.5.1","loc":297,"days":0.11,"loc_per_day":2609.4,"flagged":false},{"from":"v1.5.1","to":"v1.5.2","loc":221,"days":4.99,"loc_per_day":44.3,"flagged":false},{"from":"v1.5.2","to":"v1.6.1","loc":2232,"days":58.07,"loc_per_day":38.4,"flagged":false},{"from":"v1.6.1","to":"v1.7.0","loc":320,"days":3.56,"loc_per_day":89.9,"flagged":false},{"from":"v1.7.0","to":"v1.7.1","loc":690,"days":0.18,"loc_per_day":3759.4,"flagged":false},{"from":"v1.7.1","to":"v1.8.0","loc":3,"days":0.29,"loc_per_day":10.3,"flagged":false},{"from":"v1.8.0","to":"v1.8.1","loc":2340,"days":20.99,"loc_per_day":111.5,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":9008.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":1.0,"secrets_low_confidence":0.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"tests/navigation.spec.js","line":51,"fingerprint":"tests/navigation.spec.js:generic-api-key:51"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":72.0,"findings_high":19.0,"findings_medium":53.0,"findings_low":0.0,"weighted_findings":28.55,"scanned_lines":9008.0,"parse_errors":1.0},"findings":[{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/browser/clipboard.ts","line":15,"fingerprint":"javascript.browser.security.insecure-document-method:src/browser/clipboard.ts:15"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `template.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/browser/clipboard.ts","line":15,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/browser/clipboard.ts:15"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/browser/clipboard.ts","line":21,"fingerprint":"javascript.browser.security.insecure-document-method:src/browser/clipboard.ts:21"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `template.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/browser/clipboard.ts","line":21,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/browser/clipboard.ts:21"},{"rule_id":"opengrep/javascript.express.security.injection.tainted-sql-string","severity":"high","message":"Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available [confidence medium]","path":"src/browser/completions.ts","line":83,"fingerprint":"javascript.express.security.injection.tainted-sql-string:src/browser/completions.ts:83"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/component/element.ts","line":539,"fingerprint":"javascript.browser.security.insecure-document-method:src/component/element.ts:539"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this._shadow.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/component/element.ts","line":539,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/component/element.ts:539"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/component/element.ts","line":1856,"fingerprint":"javascript.browser.security.insecure-document-method:src/component/element.ts:1856"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this._completionPopup.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/component/element.ts","line":1856,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/component/element.ts:1856"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/render/live.ts","line":126,"fingerprint":"javascript.browser.security.insecure-document-method:src/render/live.ts:126"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this._preview.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/render/live.ts","line":126,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/render/live.ts:126"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/render/live.ts","line":134,"fingerprint":"javascript.browser.security.insecure-document-method:src/render/live.ts:134"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this._preview.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/render/live.ts","line":134,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/render/live.ts:134"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/render/live.ts","line":211,"fingerprint":"javascript.browser.security.insecure-document-method:src/render/live.ts:211"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this._liveEditor.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/render/live.ts","line":211,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/render/live.ts:211"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/render/live.ts","line":265,"fingerprint":"javascript.browser.security.insecure-document-method:src/render/live.ts:265"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `template.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/render/live.ts","line":265,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/render/live.ts:265"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/render/live.ts","line":525,"fingerprint":"javascript.browser.security.insecure-document-method:src/render/live.ts:525"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this._liveEditor.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/render/live.ts","line":525,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/render/live.ts:525"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/check-version.mjs","line":68,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/check-version.mjs:68"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/dev-server.mjs","line":140,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/dev-server.mjs:140"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `options` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"src/component/element.ts","line":724,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/component/element.ts:724"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `query` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"src/component/element.ts","line":724,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/component/element.ts:724"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/component/element.ts","line":1856,"fingerprint":"javascript.lang.security.html-in-template-string:src/component/element.ts:1856"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/component/element.ts","line":1856,"fingerprint":"javascript.lang.security.html-in-template-string:src/component/element.ts:1856"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/component/template.ts","line":5,"fingerprint":"javascript.lang.security.html-in-template-string:src/component/template.ts:5"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `query` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"src/core/text.ts","line":12,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/core/text.ts:12"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^([-*_])(?:\\s*\\1){2,}\\s*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a library wh [confidence low]","path":"src/markdown/block-syntax.ts","line":91,"fingerprint":"javascript.lang.security.audit.detect-redos:src/markdown/block-syntax.ts:91"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/html.ts","line":124,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/html.ts:124"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/html.ts","line":129,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/html.ts:129"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/html.ts","line":132,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/html.ts:132"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/html.ts","line":145,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/html.ts:145"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/html.ts","line":152,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/html.ts:152"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/html.ts","line":164,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/html.ts:164"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/html.ts","line":170,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/html.ts:170"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/html.ts","line":170,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/html.ts:170"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/html.ts","line":170,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/html.ts:170"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/html.ts","line":170,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/html.ts:170"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/html.ts","line":176,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/html.ts:176"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/html.ts","line":180,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/html.ts:180"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/inline.ts","line":36,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/inline.ts:36"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/inline.ts","line":49,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/inline.ts:49"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/inline.ts","line":113,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/inline.ts:113"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/inline.ts","line":135,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/inline.ts:135"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/inline.ts","line":141,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/inline.ts:141"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/inline.ts","line":158,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/inline.ts:158"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/inline.ts","line":161,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/inline.ts:161"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":134,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:134"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":211,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:211"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":523,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:523"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":524,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:524"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":574,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:574"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":578,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:578"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":581,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:581"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":587,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:587"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":589,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:589"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":593,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:593"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":595,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:595"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":602,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:602"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":606,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:606"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":613,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:613"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":620,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:620"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":629,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:629"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":630,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:630"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":632,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:632"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":634,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:634"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":636,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:636"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":645,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:645"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":647,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:647"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":647,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:647"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":649,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:649"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/render/live.ts","line":651,"fingerprint":"javascript.lang.security.html-in-template-string:src/render/live.ts:651"}],"evidence":[],"data":{"rulesets":["typescript","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":0.0,"vulnerabilities":0.0,"vulns_critical":0.0,"vulns_high":0.0,"vulns_medium":0.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":0.0},"findings":[],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":5.0,"findings":25.0,"findings_high":20.0,"findings_medium":0.0,"findings_low":5.0,"penalty":236.7},"findings":[{"rule_id":"zizmor/dangerous-triggers","severity":"high","message":"use of fundamentally insecure workflow trigger [confidence medium]","path":".github/workflows/commit-dist.yml","line":4,"fingerprint":"dangerous-triggers:.github/workflows/commit-dist.yml:4"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/commit-dist.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/commit-dist.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/commit-dist.yml","line":27,"fingerprint":"unpinned-uses:.github/workflows/commit-dist.yml:27"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/commit-dist.yml","line":31,"fingerprint":"unpinned-uses:.github/workflows/commit-dist.yml:31"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/fuzz.yml","line":24,"fingerprint":"unpinned-uses:.github/workflows/fuzz.yml:24"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/fuzz.yml","line":29,"fingerprint":"unpinned-uses:.github/workflows/fuzz.yml:29"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/fuzz.yml","line":52,"fingerprint":"unpinned-uses:.github/workflows/fuzz.yml:52"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/generate-dist.yml","line":17,"fingerprint":"unpinned-uses:.github/workflows/generate-dist.yml:17"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/generate-dist.yml","line":22,"fingerprint":"unpinned-uses:.github/workflows/generate-dist.yml:22"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/generate-dist.yml","line":33,"fingerprint":"unpinned-uses:.github/workflows/generate-dist.yml:33"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish.yml","line":16,"fingerprint":"unpinned-uses:.github/workflows/publish.yml:16"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/publish.yml","line":21,"fingerprint":"unpinned-uses:.github/workflows/publish.yml:21"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":18,"fingerprint":"unpinned-uses:.github/workflows/test.yml:18"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/test.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":39,"fingerprint":"unpinned-uses:.github/workflows/test.yml:39"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":49,"fingerprint":"unpinned-uses:.github/workflows/test.yml:49"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":52,"fingerprint":"unpinned-uses:.github/workflows/test.yml:52"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":68,"fingerprint":"unpinned-uses:.github/workflows/test.yml:68"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":80,"fingerprint":"unpinned-uses:.github/workflows/test.yml:80"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":81,"fingerprint":"unpinned-uses:.github/workflows/test.yml:81"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/fuzz.yml","line":23,"fingerprint":"artipacked:.github/workflows/fuzz.yml:23"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/publish.yml","line":15,"fingerprint":"artipacked:.github/workflows/publish.yml:15"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":17,"fingerprint":"artipacked:.github/workflows/test.yml:17"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":48,"fingerprint":"artipacked:.github/workflows/test.yml:48"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":80,"fingerprint":"artipacked:.github/workflows/test.yml:80"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0217,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"readme-download-lure","description":"gives an archive password","ref":"README.md","url":null,"weight":0.0}],"data":{"signals":["readme-download-lure"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1308.0,"function_nloc":7302.0,"mean_ccn":3.39,"p90_ccn":8.0,"complex_functions":42.0,"long_functions":5.0,"many_param_functions":0.0,"risky_nloc_share":0.3177},"findings":[],"evidence":[{"kind":"complex-function","description":"_onKeyDown in src/component/element.ts: complexity 136, 155 lines","ref":"src/component/element.ts","url":"https://github.com/Brostoffed/writemark/blob/ad67772b9dfbd2e94b0eb52628916a624ea6c995/src/component/element.ts#L1083","weight":1.0},{"kind":"complex-function","description":"_onLiveBeforeInput in src/browser/input.ts: complexity 66, 109 lines","ref":"src/browser/input.ts","url":"https://github.com/Brostoffed/writemark/blob/ad67772b9dfbd2e94b0eb52628916a624ea6c995/src/browser/input.ts#L136","weight":1.0},{"kind":"complex-function","description":"_restoreLiveSelection in src/browser/selection.ts: complexity 66, 200 lines","ref":"src/browser/selection.ts","url":"https://github.com/Brostoffed/writemark/blob/ad67772b9dfbd2e94b0eb52628916a624ea6c995/src/browser/selection.ts#L659","weight":1.0},{"kind":"complex-function","description":"_onLiveInput in src/browser/input.ts: complexity 54, 143 lines","ref":"src/browser/input.ts","url":"https://github.com/Brostoffed/writemark/blob/ad67772b9dfbd2e94b0eb52628916a624ea6c995/src/browser/input.ts#L547","weight":0.9},{"kind":"complex-function","description":"parseListItem in src/markdown/block-syntax.ts: complexity 36, 20 lines","ref":"src/markdown/block-syntax.ts","url":"https://github.com/Brostoffed/writemark/blob/ad67772b9dfbd2e94b0eb52628916a624ea6c995/src/markdown/block-syntax.ts#L29","weight":0.6},{"kind":"complex-function","description":"parseBlocks in src/markdown/blocks.ts: complexity 36, 54 lines","ref":"src/markdown/blocks.ts","url":"https://github.com/Brostoffed/writemark/blob/ad67772b9dfbd2e94b0eb52628916a624ea6c995/src/markdown/blocks.ts#L38","weight":0.6},{"kind":"complex-function","description":"parseInlineLinkAt in src/markdown/inline.ts: complexity 36, 58 lines","ref":"src/markdown/inline.ts","url":"https://github.com/Brostoffed/writemark/blob/ad67772b9dfbd2e94b0eb52628916a624ea6c995/src/markdown/inline.ts#L84","weight":0.6},{"kind":"complex-function","description":"walk in src/browser/clipboard.ts: complexity 35, 38 lines","ref":"src/browser/clipboard.ts","url":"https://github.com/Brostoffed/writemark/blob/ad67772b9dfbd2e94b0eb52628916a624ea6c995/src/browser/clipboard.ts#L23","weight":0.5833333333333334},{"kind":"complex-function","description":"_getActiveStateIds in src/component/element.ts: complexity 35, 49 lines","ref":"src/component/element.ts","url":"https://github.com/Brostoffed/writemark/blob/ad67772b9dfbd2e94b0eb52628916a624ea6c995/src/component/element.ts#L651","weight":0.5833333333333334},{"kind":"complex-function","description":"_acceptCompletion in src/browser/completions.ts: complexity 34, 59 lines","ref":"src/browser/completions.ts","url":"https://github.com/Brostoffed/writemark/blob/ad67772b9dfbd2e94b0eb52628916a624ea6c995/src/browser/completions.ts#L225","weight":0.5666666666666667}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":7119.0,"duplicated_lines":142.0,"duplicated_share":0.0199,"files":51.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: src/browser/completions.ts:121 and src/browser/completions.ts:148","ref":"src/browser/completions.ts","url":"https://github.com/Brostoffed/writemark/blob/ad67772b9dfbd2e94b0eb52628916a624ea6c995/src/browser/completions.ts#L121","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/browser/input.ts:80 and src/browser/input.ts:572","ref":"src/browser/input.ts","url":"https://github.com/Brostoffed/writemark/blob/ad67772b9dfbd2e94b0eb52628916a624ea6c995/src/browser/input.ts#L80","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/browser/types.ts:94 and src/browser/types.ts:167","ref":"src/browser/types.ts","url":"https://github.com/Brostoffed/writemark/blob/ad67772b9dfbd2e94b0eb52628916a624ea6c995/src/browser/types.ts#L94","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/component/element.ts:1108 and src/component/element.ts:1121","ref":"src/component/element.ts","url":"https://github.com/Brostoffed/writemark/blob/ad67772b9dfbd2e94b0eb52628916a624ea6c995/src/component/element.ts#L1108","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/types.ts:134 and src/types.ts:353","ref":"src/types.ts","url":"https://github.com/Brostoffed/writemark/blob/ad67772b9dfbd2e94b0eb52628916a624ea6c995/src/types.ts#L134","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":53.0,"weighted_findings":18.25,"scanned_lines":9008.0,"category:correctness":53.0},"findings":[{"rule_id":"opengrep/typescript.lang.correctness.useless-ternary","severity":"high","message":"It looks like no matter how ctx.selectionStart < ctx.value.length && ctx.value[ctx.selectionStart] !== \"\\n\" is evaluated, this expression returns \"\\n\". This is probably a copy-paste error.","path":"src/actions/blocks.ts","line":30,"fingerprint":"typescript.lang.correctness.useless-ternary:src/actions/blocks.ts:30"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/build.mjs","line":78,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/build.mjs:78"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/build.mjs","line":117,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/build.mjs:117"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/check-release-change.mjs","line":28,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/check-release-change.mjs:28"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/build.mjs","line":92,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/build.mjs:92"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/build.mjs","line":92,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/build.mjs:92"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/build.mjs","line":101,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/build.mjs:101"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/build.mjs","line":101,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/build.mjs:101"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-release-change.mjs","line":76,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-release-change.mjs:76"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/check-release-change.mjs","line":76,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/check-release-change.mjs:76"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/actions/blocks.ts","line":32,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/actions/blocks.ts:32"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/actions/blocks.ts","line":32,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/actions/blocks.ts:32"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/actions/blocks.ts","line":32,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/actions/blocks.ts:32"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/actions/blocks.ts","line":32,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/actions/blocks.ts:32"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/actions/blocks.ts","line":32,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/actions/blocks.ts:32"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/actions/blocks.ts","line":32,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/actions/blocks.ts:32"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/actions/blocks.ts","line":32,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/actions/blocks.ts:32"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/actions/blocks.ts","line":32,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/actions/blocks.ts:32"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/actions/blocks.ts","line":32,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/actions/blocks.ts:32"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/actions/blocks.ts","line":32,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/actions/blocks.ts:32"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/actions/blocks.ts","line":32,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/actions/blocks.ts:32"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/actions/blocks.ts","line":32,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/actions/blocks.ts:32"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/actions/tables.ts","line":114,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/actions/tables.ts:114"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/actions/tables.ts","line":114,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/actions/tables.ts:114"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/actions/tables.ts","line":114,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/actions/tables.ts:114"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/actions/tables.ts","line":114,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/actions/tables.ts:114"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/browser/clipboard.ts","line":56,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/browser/clipboard.ts:56"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/browser/clipboard.ts","line":56,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/browser/clipboard.ts:56"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/browser/clipboard.ts","line":56,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/browser/clipboard.ts:56"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/browser/clipboard.ts","line":56,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/browser/clipboard.ts:56"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/browser/clipboard.ts","line":71,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/browser/clipboard.ts:71"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/browser/clipboard.ts","line":71,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/browser/clipboard.ts:71"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/browser/clipboard.ts","line":71,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/browser/clipboard.ts:71"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/browser/clipboard.ts","line":71,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/browser/clipboard.ts:71"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/render/live.ts","line":645,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/render/live.ts:645"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/render/live.ts","line":645,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/render/live.ts:645"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/render/live.ts","line":645,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/render/live.ts:645"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/render/live.ts","line":645,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/render/live.ts:645"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/render/live.ts","line":645,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/render/live.ts:645"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/render/live.ts","line":645,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/render/live.ts:645"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/render/live.ts","line":645,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/render/live.ts:645"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/render/live.ts","line":647,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/render/live.ts:647"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/render/live.ts","line":647,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/render/live.ts:647"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/render/live.ts","line":647,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/render/live.ts:647"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/render/live.ts","line":647,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/render/live.ts:647"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/render/live.ts","line":647,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/render/live.ts:647"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/render/live.ts","line":647,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/render/live.ts:647"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/render/live.ts","line":647,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/render/live.ts:647"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/render/live.ts","line":647,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/render/live.ts:647"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/render/live.ts","line":647,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/render/live.ts:647"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/render/live.ts","line":647,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/render/live.ts:647"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/render/live.ts","line":647,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/render/live.ts:647"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/render/live.ts","line":647,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/render/live.ts:647"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":11323.0,"source_lines":9008.0,"test_ratio":1.257,"ci_files":5.0,"cochange_share":0.725,"cochange_commits":40.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/commit-dist.yml","ref":".github/workflows/commit-dist.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/fuzz.yml","ref":".github/workflows/fuzz.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/generate-dist.yml","ref":".github/workflows/generate-dist.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/publish.yml","ref":".github/workflows/publish.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/test.yml","ref":".github/workflows/test.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm test, npm run test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm test","npm run test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":1.0,"readme_lines":439.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: tsconfig.json","ref":"tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":8404.0,"other_lines":604.0,"files_blamed":51.0,"blame_failures":0.0,"quality:ai_findings":53.0,"quality:ai_per_kloc":6.307,"quality:other_findings":0.0,"quality:other_per_kloc":0.0,"security:ai_findings":70.0,"security:ai_per_kloc":8.329,"security:other_findings":2.0,"security:other_per_kloc":3.311,"security:ratio":2.52},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}