{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T15:18:40.697634Z","repo":{"ref":{"host":"github.com","owner":"Chalarangelo","name":"30-seconds-of-code"},"default_branch":"master","clone_url":"https://github.com/Chalarangelo/30-seconds-of-code.git","html_url":"https://github.com/Chalarangelo/30-seconds-of-code","description":"Coding articles to level up your development skills","stars":129507,"forks":12521,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":742658,"primary_language":"JavaScript","license_spdx":"CC-BY-4.0","created_at":"2017-11-29T17:35:03Z","pushed_at":"2026-11-14T01:01:04Z","security_policy_url":"https://github.com/Chalarangelo/30-seconds-of-code/security/policy","distribution":{"owner_created_at":"2014-07-27T14:40:23Z","owner_type":"User","release_assets":[]}},"commit_sha":"bd756f8b2283a38560efe83cb30af38324d4e9e9","profile":{"lines_by_language":{"JavaScript":9724,"TypeScript":10},"files_by_category":{"binary":2128,"docs":784,"other":114,"config":110,"source":87,"oversized":54,"test":21,"generated":1,"vendored":1},"source_lines":7911,"test_lines":1823},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.0521,"estimated_share":0.0,"ai_artifacts":1.0,"flagged_work_units":3.0,"flagged_releases":0.0,"style_index":0.695},"summary":"Weak signals consistent with AI-assisted development. 1 commit(s) carry explicit AI attribution, too few to characterize the codebase."},"quality":{"score":75.1,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":89.3,"duplication":97.0,"lint":98.4,"testing":69.6,"docs":80.0,"type_safety":40.0,"process":5.0},"summary":"Code quality is adequate: test-to-source ratio 0.23, CI runs tests; 4% of function code in complex or long functions; 0% duplicated lines. Weakest area: process."},"security":{"score":53.4,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":96.7,"sast":56.3,"dependencies":8.8,"ci_actions":34.0,"posture":60.0,"scorecard":51.7},"summary":"Security posture is weak: 58 known vulnerabilities in 22 dependencies; 8 high-severity SAST findings; 5 high-severity workflow issues. Weakest area: dependencies."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"ok","tool_version":"scorecard v5.6.0","metrics":{"aggregate":4.8,"check:Security-Policy":10.0,"check:Maintained":1.0,"check:Dangerous-Workflow":10.0,"check:Token-Permissions":0.0,"check:Code-Review":0.0,"check:CII-Best-Practices":0.0,"check:Binary-Artifacts":10.0,"check:License":10.0,"check:Fuzzing":0.0,"check:Pinned-Dependencies":1.0,"check:SAST":10.0},"findings":[],"evidence":[{"kind":"scorecard-check","description":"Scorecard Security-Policy: 10/10 (security policy file detected)","ref":"Security-Policy","url":"https://scorecard.dev/viewer/?uri=github.com/Chalarangelo/30-seconds-of-code","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Maintained: 1/10 (2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1)","ref":"Maintained","url":"https://scorecard.dev/viewer/?uri=github.com/Chalarangelo/30-seconds-of-code","weight":0.9},{"kind":"scorecard-check","description":"Scorecard Dangerous-Workflow: 10/10 (no dangerous workflow patterns detected)","ref":"Dangerous-Workflow","url":"https://scorecard.dev/viewer/?uri=github.com/Chalarangelo/30-seconds-of-code","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Token-Permissions: 0/10 (detected GitHub workflow tokens with excessive permissions)","ref":"Token-Permissions","url":"https://scorecard.dev/viewer/?uri=github.com/Chalarangelo/30-seconds-of-code","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Code-Review: 0/10 (Found 0/7 approved changesets -- score normalized to 0)","ref":"Code-Review","url":"https://scorecard.dev/viewer/?uri=github.com/Chalarangelo/30-seconds-of-code","weight":1.0},{"kind":"scorecard-check","description":"Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)","ref":"CII-Best-Practices","url":"https://scorecard.dev/viewer/?uri=github.com/Chalarangelo/30-seconds-of-code","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Binary-Artifacts: 10/10 (no binaries found in the repo)","ref":"Binary-Artifacts","url":"https://scorecard.dev/viewer/?uri=github.com/Chalarangelo/30-seconds-of-code","weight":0.0},{"kind":"scorecard-check","description":"Scorecard License: 10/10 (license file detected)","ref":"License","url":"https://scorecard.dev/viewer/?uri=github.com/Chalarangelo/30-seconds-of-code","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Fuzzing: 0/10 (project is not fuzzed)","ref":"Fuzzing","url":"https://scorecard.dev/viewer/?uri=github.com/Chalarangelo/30-seconds-of-code","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Pinned-Dependencies: 1/10 (dependency not pinned by hash detected -- score normalized to 1)","ref":"Pinned-Dependencies","url":"https://scorecard.dev/viewer/?uri=github.com/Chalarangelo/30-seconds-of-code","weight":0.9},{"kind":"scorecard-check","description":"Scorecard SAST: 10/10 (SAST tool is run on all commits)","ref":"SAST","url":"https://scorecard.dev/viewer/?uri=github.com/Chalarangelo/30-seconds-of-code","weight":0.0}],"data":{"date":"2026-11-09","commit":"bd756f8b2283a38560efe83cb30af38324d4e9e9","matches_head":true},"error":null},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":24.0,"checked":24.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":10213.0,"attributed_commits":1.0,"attributed_commit_share":0.00009791442279447762,"effective_loc":162750.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"GitHub Copilot coding agent: 1 attributed commits, 0 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"30f147026dc5e00a38c2a8e046bbea8412a8929a","url":"https://github.com/Chalarangelo/30-seconds-of-code/commit/30f147026dc5e00a38c2a8e046bbea8412a8929a","weight":0.9}],"data":{"attributed_loc_by_commit":{"30f147026dc5e00a38c2a8e046bbea8412a8929a":0},"tools":{"github-copilot":{"name":"GitHub Copilot coding agent","commits":1,"loc":0,"first_seen":1747847708,"last_seen":1747847708}},"monthly":{"2017-11":{"loc":43,"attributed_loc":0},"2017-12":{"loc":1939,"attributed_loc":0},"2018-01":{"loc":10283,"attributed_loc":0},"2018-02":{"loc":15188,"attributed_loc":0},"2018-03":{"loc":1341,"attributed_loc":0},"2018-04":{"loc":655,"attributed_loc":0},"2018-05":{"loc":215,"attributed_loc":0},"2018-06":{"loc":9855,"attributed_loc":0},"2018-07":{"loc":374,"attributed_loc":0},"2018-08":{"loc":3392,"attributed_loc":0},"2018-09":{"loc":861,"attributed_loc":0},"2018-10":{"loc":4836,"attributed_loc":0},"2018-11":{"loc":4311,"attributed_loc":0},"2018-12":{"loc":5615,"attributed_loc":0},"2019-01":{"loc":4878,"attributed_loc":0},"2019-02":{"loc":838,"attributed_loc":0},"2019-03":{"loc":210,"attributed_loc":0},"2019-04":{"loc":21,"attributed_loc":0},"2019-05":{"loc":3321,"attributed_loc":0},"2019-06":{"loc":221,"attributed_loc":0},"2019-07":{"loc":119,"attributed_loc":0},"2019-08":{"loc":11291,"attributed_loc":0},"2019-09":{"loc":1623,"attributed_loc":0},"2019-10":{"loc":5606,"attributed_loc":0},"2019-11":{"loc":5721,"attributed_loc":0},"2019-12":{"loc":911,"attributed_loc":0},"2020-01":{"loc":1498,"attributed_loc":0},"2020-02":{"loc":2158,"attributed_loc":0},"2020-03":{"loc":2237,"attributed_loc":0},"2020-04":{"loc":4241,"attributed_loc":0},"2020-05":{"loc":770,"attributed_loc":0},"2020-06":{"loc":1518,"attributed_loc":0},"2020-07":{"loc":1316,"attributed_loc":0},"2020-08":{"loc":2006,"attributed_loc":0},"2020-09":{"loc":2131,"attributed_loc":0},"2020-10":{"loc":185,"attributed_loc":0},"2020-11":{"loc":633,"attributed_loc":0},"2020-12":{"loc":7733,"attributed_loc":0},"2021-01":{"loc":2149,"attributed_loc":0},"2021-02":{"loc":1312,"attributed_loc":0},"2021-03":{"loc":593,"attributed_loc":0},"2021-04":{"loc":1143,"attributed_loc":0},"2021-05":{"loc":1122,"attributed_loc":0},"2021-06":{"loc":643,"attributed_loc":0},"2021-07":{"loc":142,"attributed_loc":0},"2021-08":{"loc":277,"attributed_loc":0},"2021-09":{"loc":604,"attributed_loc":0},"2021-10":{"loc":0,"attributed_loc":0},"2021-11":{"loc":1,"attributed_loc":0},"2021-12":{"loc":0,"attributed_loc":0},"2022-01":{"loc":7887,"attributed_loc":0},"2022-02":{"loc":1120,"attributed_loc":0},"2022-03":{"loc":452,"attributed_loc":0},"2022-04":{"loc":0,"attributed_loc":0},"2022-05":{"loc":48,"attributed_loc":0},"2022-06":{"loc":0,"attributed_loc":0},"2022-07":{"loc":0,"attributed_loc":0},"2022-08":{"loc":0,"attributed_loc":0},"2022-09":{"loc":80,"attributed_loc":0},"2022-10":{"loc":19,"attributed_loc":0},"2022-11":{"loc":72,"attributed_loc":0},"2022-12":{"loc":148,"attributed_loc":0},"2023-01":{"loc":88,"attributed_loc":0},"2023-02":{"loc":975,"attributed_loc":0},"2023-03":{"loc":759,"attributed_loc":0},"2023-04":{"loc":547,"attributed_loc":0},"2023-05":{"loc":1172,"attributed_loc":0},"2023-06":{"loc":303,"attributed_loc":0},"2023-08":{"loc":424,"attributed_loc":0},"2023-09":{"loc":370,"attributed_loc":0},"2023-10":{"loc":2173,"attributed_loc":0},"2023-11":{"loc":410,"attributed_loc":0},"2023-12":{"loc":575,"attributed_loc":0},"2024-01":{"loc":4,"attributed_loc":0},"2024-02":{"loc":0,"attributed_loc":0},"2024-03":{"loc":0,"attributed_loc":0},"2024-04":{"loc":64,"attributed_loc":0},"2024-05":{"loc":53,"attributed_loc":0},"2024-06":{"loc":3075,"attributed_loc":0},"2024-07":{"loc":3136,"attributed_loc":0},"2024-08":{"loc":3873,"attributed_loc":0},"2024-09":{"loc":12,"attributed_loc":0},"2024-10":{"loc":0,"attributed_loc":0},"2024-12":{"loc":74,"attributed_loc":0},"2025-01":{"loc":70,"attributed_loc":0},"2025-02":{"loc":0,"attributed_loc":0},"2025-03":{"loc":4153,"attributed_loc":0},"2025-04":{"loc":2334,"attributed_loc":0},"2025-05":{"loc":184,"attributed_loc":0},"2025-06":{"loc":14,"attributed_loc":0},"2025-07":{"loc":2,"attributed_loc":0},"2025-08":{"loc":0,"attributed_loc":0},"2025-09":{"loc":0,"attributed_loc":0},"2025-10":{"loc":0,"attributed_loc":0},"2025-11":{"loc":0,"attributed_loc":0},"2025-12":{"loc":0,"attributed_loc":0},"2026-01":{"loc":0,"attributed_loc":0},"2026-02":{"loc":0,"attributed_loc":0},"2026-03":{"loc":0,"attributed_loc":0},"2026-04":{"loc":0,"attributed_loc":0},"2026-06":{"loc":0,"attributed_loc":0},"2026-07":{"loc":0,"attributed_loc":0},"2026-08":{"loc":0,"attributed_loc":0},"2026-09":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1749297863.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":".github/copilot-instructions.md (github-copilot configuration)","ref":".github/copilot-instructions.md","url":"https://github.com/Chalarangelo/30-seconds-of-code/blob/bd756f8b2283a38560efe83cb30af38324d4e9e9/.github/copilot-instructions.md","weight":0.5}],"data":{"artifacts":[{"tool":"github-copilot","path":".github/copilot-instructions.md","added_at":1749297863}],"workflows":[],"tools":["github-copilot"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"work_units":1341.0,"flagged_units":3.0,"pre_ai_era_bursts":8.0,"pre_ai_era_measured_loc":123765.0,"pre_ai_era_burst_loc":33151.0,"measured_loc":159459.0,"flagged_loc":8481.0,"flagged_loc_share":0.053186085451432656,"max_loc_per_hour":2242.5465838509313,"median_loc_per_hour":68.06021827369604,"pr_timed_units":0.0,"excluded_import_loc":3291.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"2,407 lines of first-party code in ~1.1h (2,243 lines/hour, 4 commit session)","ref":"acd77db4610466fb9588920615fd214aafc0b977","url":"https://github.com/Chalarangelo/30-seconds-of-code/commit/acd77db4610466fb9588920615fd214aafc0b977","weight":0.6},{"kind":"velocity-burst","description":"3,394 lines of first-party code in ~4.2h (817 lines/hour, 15 commit session)","ref":"a6ee62e3579354559d09f3ea9a24936f3307c097","url":"https://github.com/Chalarangelo/30-seconds-of-code/commit/a6ee62e3579354559d09f3ea9a24936f3307c097","weight":0.2451197004146048},{"kind":"velocity-burst","description":"2,680 lines of first-party code in ~4.5h (591 lines/hour, 24 commit session)","ref":"62e6109ef105e27fbec1864fa65c4988b8bc84a6","url":"https://github.com/Chalarangelo/30-seconds-of-code/commit/62e6109ef105e27fbec1864fa65c4988b8bc84a6","weight":0.1771900826446281}],"data":{"flagged_loc_by_commit":{"857383832791a9ff1632bcaf31d05ad1196aa4e8":7,"d6ce4d99d0b01ab75734fc2c93d0cdb53e70c88c":14,"e7ece8c92a348516409e208a414e7b4a56855edb":22,"469a6bcde06801270d69432b3f576ad971c54010":68,"e0251d9fe9d70ea57d5c98b5fe2b59b3132cd7f1":17,"0f144b915e3586197ba72cd75d3651d391ae0d90":242,"1b86843356f68b1ac8c42c739fb6c6a8f1445b23":221,"ce36aaf8afe2d40e605c3b19e77620e9e1b47f31":281,"c50fdb821ef82969d6d621f01601efb1f3ff402c":66,"92037596f1c86c0c63f1e6aa02d5dfe1feab1d71":36,"a8e211a9ae1db9e75b26b9359d42fd1663028b14":11,"828c045c226dd7c93cee181892f52de31475f109":48,"502e0ff1557d4caccb5607137852ded1cf8c0c59":83,"c1006b63fc01d52779346379a683b65b881cc179":17,"3ec07bbe0809ef327c9dae797b0a855b1f70618e":7,"08ed400d8c4e134cf9d6b72a6627e90194643121":6,"32a01f216fe3a96698d45553bb3f6c89874a7a0a":88,"e38f9105b5b307dbc87f83337d3f5bd7774063c7":16,"6bf80a16bfeecb39ea994a099dba2aa4a7181fb7":409,"2463787faf2fd6d1933c6f77f022b239ca0925b8":516,"f2bd7d4680d6c3fdcfff6c7ed38dfe69e180b753":197,"0d1d29fbb65e38830944c02b58a8432cd2305061":21,"c44bf5ded8610ef82a3fe561f58b5baf556515f7":101,"62e6109ef105e27fbec1864fa65c4988b8bc84a6":186,"ce23e117a3b71c93687e650f2788a6099bf66edc":103,"43c93d1811511970efb6942b324b71e25b80813c":258,"faccdf406f3904f082ac9e16ee67660fc343e74a":7,"acd77db4610466fb9588920615fd214aafc0b977":2039,"b47602a693ebb8f99625f748e23c68471e7ea19d":24,"49cbc8f92ef519e07d07387259ec8806951a2dcc":180,"579bbb44066a2124aa64e0d8b51dd1f7c71602e8":574,"ae8fdad76b1daa52f9e29f0fba0cb7cd7f3840d1":267,"ec37b8bdf21ed9b2545075757121aa33024e095d":396,"dadb6222426227c9390bc25a85b2d13a7897e32f":116,"bbdeca75fb3554d670018e45c1c029258a74cdf7":139,"ce67c9f7c2595000ca278b45757665daed78de0a":490,"4c80f7e13b4103ba69de87b9611a8f1ba9f406f3":158,"93fe7e25a3bf5bf9476bde3201c33c672fa90346":47,"a6618121c61225c4f3e1dfb8ae19037fefd26f45":146,"cb4c4b0e61b3a3ec8f25ec639523e85b6070256b":57,"b680445ccbffbd66b0837ee2c965eb21eb482927":516,"4ef1a8f20d766e8c475cdddc3ab138e65e4ce70f":267,"a6ee62e3579354559d09f3ea9a24936f3307c097":17},"excluded_import_commits":["05c74f66309f50fec7a07e1ea28d08dfc8561b1b"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"releases":4.0,"flagged_releases":0.0,"max_loc_per_day":431.9},"findings":[],"evidence":[],"data":{"releases":[{"from":"v11.0.0","to":"v12.0.0","loc":6414,"days":220.15,"loc_per_day":29.1,"flagged":false},{"from":"v12.0.0","to":"v12.1.0","loc":3396,"days":7.86,"loc_per_day":431.9,"flagged":false},{"from":"v12.1.0","to":"v13.0.0","loc":633,"days":154.95,"loc_per_day":4.1,"flagged":false},{"from":"v13.0.0","to":"v14.0.0","loc":6487,"days":105.87,"loc_per_day":61.3,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":7911.0,"index":0.695,"count:narrated_steps":4.0,"per_kloc:narrated_steps":0.506,"files:narrated_steps":1.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":3.0,"per_kloc:emoji_in_code":0.379,"files:emoji_in_code":1.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 2.","ref":"src/lib/search/porterStemmer.js:123","url":"https://github.com/Chalarangelo/30-seconds-of-code/blob/bd756f8b2283a38560efe83cb30af38324d4e9e9/src/lib/search/porterStemmer.js#L123","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 3.","ref":"src/lib/search/porterStemmer.js:127","url":"https://github.com/Chalarangelo/30-seconds-of-code/blob/bd756f8b2283a38560efe83cb30af38324d4e9e9/src/lib/search/porterStemmer.js#L127","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 4.","ref":"src/lib/search/porterStemmer.js:131","url":"https://github.com/Chalarangelo/30-seconds-of-code/blob/bd756f8b2283a38560efe83cb30af38324d4e9e9/src/lib/search/porterStemmer.js#L131","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 5.","ref":"src/lib/search/porterStemmer.js:136","url":"https://github.com/Chalarangelo/30-seconds-of-code/blob/bd756f8b2283a38560efe83cb30af38324d4e9e9/src/lib/search/porterStemmer.js#L136","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":1.0,"secrets_low_confidence":0.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 5e1833c967); removed from the current tree but still retrievable","path":"website/web/Lib/site-packages/tests/test_oauth.py","line":440,"fingerprint":"5e1833c967063d44951ed549954d6e4cb8b929a0:website/web/Lib/site-packages/tests/test_oauth.py:generic-api-key:440"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":36.0,"findings_high":8.0,"findings_medium":28.0,"findings_low":0.0,"weighted_findings":13.0,"scanned_lines":7911.0,"parse_errors":19.0},"findings":[{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"content/components/scripts/latex-expression.mjs","line":23,"fingerprint":"javascript.browser.security.insecure-document-method:content/components/scripts/latex-expression.mjs:23"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `figure.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"content/components/scripts/latex-expression.mjs","line":23,"fingerprint":"javascript.browser.security.insecure-innerhtml:content/components/scripts/latex-expression.mjs:23"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/astro/scripts/omnisearch.js","line":78,"fingerprint":"javascript.browser.security.insecure-document-method:src/astro/scripts/omnisearch.js:78"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.resultsSection.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/astro/scripts/omnisearch.js","line":78,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/astro/scripts/omnisearch.js:78"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/astro/scripts/omnisearch.js","line":83,"fingerprint":"javascript.browser.security.insecure-document-method:src/astro/scripts/omnisearch.js:83"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.resultsSection.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/astro/scripts/omnisearch.js","line":83,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/astro/scripts/omnisearch.js:83"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/astro/scripts/omnisearch.js","line":86,"fingerprint":"javascript.browser.security.insecure-document-method:src/astro/scripts/omnisearch.js:86"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this.resultsSection.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"src/astro/scripts/omnisearch.js","line":86,"fingerprint":"javascript.browser.security.insecure-innerhtml:src/astro/scripts/omnisearch.js:86"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/astro/scripts/omnisearch.js","line":89,"fingerprint":"javascript.lang.security.html-in-template-string:src/astro/scripts/omnisearch.js:89"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/astro/scripts/omnisearch.js","line":95,"fingerprint":"javascript.lang.security.html-in-template-string:src/astro/scripts/omnisearch.js:95"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/astro/scripts/omnisearch.js","line":114,"fingerprint":"javascript.lang.security.html-in-template-string:src/astro/scripts/omnisearch.js:114"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"src/core/recordSet.js","line":7,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:src/core/recordSet.js:7"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"src/lib/contentUtils/contentCreator.js","line":51,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:src/lib/contentUtils/contentCreator.js:51"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"src/lib/contentUtils/fileHandler.js","line":26,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:src/lib/contentUtils/fileHandler.js:26"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"src/lib/contentUtils/fileHandler.js","line":47,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:src/lib/contentUtils/fileHandler.js:47"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `openingBracket` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user- [confidence low]","path":"src/lib/contentUtils/markdownParser/codeHighlighters/utils/metaParser.js","line":59,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/lib/contentUtils/markdownParser/codeHighlighters/utils/metaParser.js:59"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `str` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled  [confidence low]","path":"src/lib/contentUtils/markdownParser/codeHighlighters/utils/metaParser.js","line":149,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/lib/contentUtils/markdownParser/codeHighlighters/utils/metaParser.js:149"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `openingBracket` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user- [confidence low]","path":"src/lib/contentUtils/markdownParser/codeHighlighters/utils/metaParser.js","line":203,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/lib/contentUtils/markdownParser/codeHighlighters/utils/metaParser.js:203"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/lib/contentUtils/markdownParser/markdownParser.js","line":115,"fingerprint":"javascript.lang.security.html-in-template-string:src/lib/contentUtils/markdownParser/markdownParser.js:115"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/lib/contentUtils/markdownParser/plugins/ast/embedCodepensFromLinks.js","line":50,"fingerprint":"javascript.lang.security.html-in-template-string:src/lib/contentUtils/markdownParser/plugins/ast/embedCodepensFromLinks.js:50"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/lib/contentUtils/markdownParser/plugins/ast/highlightCode.js","line":97,"fingerprint":"javascript.lang.security.html-in-template-string:src/lib/contentUtils/markdownParser/plugins/ast/highlightCode.js:97"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/lib/contentUtils/markdownParser/plugins/ast/transformArticleEmbeds.js","line":45,"fingerprint":"javascript.lang.security.html-in-template-string:src/lib/contentUtils/markdownParser/plugins/ast/transformArticleEmbeds.js:45"},{"rule_id":"opengrep/javascript.browser.security.raw-html-join","severity":"medium","message":"User controlled data in a HTML string may result in XSS [confidence low]","path":"src/lib/contentUtils/markdownParser/plugins/hast/loadWebComponents.js","line":22,"fingerprint":"javascript.browser.security.raw-html-join:src/lib/contentUtils/markdownParser/plugins/hast/loadWebComponents.js:22"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/lib/contentUtils/markdownParser/plugins/hast/loadWebComponents.js","line":23,"fingerprint":"javascript.lang.security.html-in-template-string:src/lib/contentUtils/markdownParser/plugins/hast/loadWebComponents.js:23"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `types` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"src/lib/contentUtils/markdownParser/plugins/hast/transformAdmonitions.js","line":37,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/lib/contentUtils/markdownParser/plugins/hast/transformAdmonitions.js:37"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/lib/contentUtils/tocReader.js","line":19,"fingerprint":"javascript.lang.security.html-in-template-string:src/lib/contentUtils/tocReader.js:19"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/lib/contentUtils/tocReader.js","line":49,"fingerprint":"javascript.lang.security.html-in-template-string:src/lib/contentUtils/tocReader.js:49"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/lib/contentUtils/tocReader.js","line":51,"fingerprint":"javascript.lang.security.html-in-template-string:src/lib/contentUtils/tocReader.js:51"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/lib/contentUtils/tocReader.js","line":56,"fingerprint":"javascript.lang.security.html-in-template-string:src/lib/contentUtils/tocReader.js:56"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/lib/feed.js","line":43,"fingerprint":"javascript.lang.security.html-in-template-string:src/lib/feed.js:43"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `file` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"src/lib/preparedQueries.js","line":62,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:src/lib/preparedQueries.js:62"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `term` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"src/lib/search/documentSearch.js","line":75,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/lib/search/documentSearch.js:75"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"src/lib/search/server.js","line":75,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:src/lib/search/server.js:75"},{"rule_id":"opengrep/javascript.lang.security.audit.incomplete-sanitization","severity":"medium","message":"`tkn.replace(/^['-]+|['-]+$/g, '').replace` method will only replace the first occurrence when used with a string argument (\"'\"). If this method is used for escaping of dangerous data then there is a possibility for a bypass. Try to use sanitization library instead or use a Regex with a global flag. [confidence low]","path":"src/lib/search/utils.js","line":14,"fingerprint":"javascript.lang.security.audit.incomplete-sanitization:src/lib/search/utils.js:14"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/lib/sitemap.js","line":36,"fingerprint":"javascript.lang.security.html-in-template-string:src/lib/sitemap.js:36"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/models/contentModel.js","line":152,"fingerprint":"javascript.lang.security.html-in-template-string:src/models/contentModel.js:152"}],"evidence":[],"data":{"rulesets":["javascript","typescript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":22.0,"vulnerabilities":58.0,"vulns_critical":3.0,"vulns_high":25.0,"vulns_medium":24.0,"vulns_low":6.0,"vulns_unknown":0.0,"penalty":146.0},"findings":[{"rule_id":"osv/GHSA-26w7-cxv4-gfx2","severity":"critical","message":"astro@6.4.6 (npm) is affected by GHSA-26w7-cxv4-gfx2","path":"package-lock.json","line":null,"fingerprint":"astro@6.4.6 (npm):GHSA-26w7-cxv4-gfx2"},{"rule_id":"osv/GHSA-5gmw-xhrv-c9v3","severity":"critical","message":"tinypool@1.1.1 (npm) is affected by GHSA-5gmw-xhrv-c9v3","path":"package-lock.json","line":null,"fingerprint":"tinypool@1.1.1 (npm):GHSA-5gmw-xhrv-c9v3"},{"rule_id":"osv/GHSA-85c8-ppgw-ccpr","severity":"critical","message":"tinypool@1.1.1 (npm) is affected by GHSA-85c8-ppgw-ccpr","path":"package-lock.json","line":null,"fingerprint":"tinypool@1.1.1 (npm):GHSA-85c8-ppgw-ccpr"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.16 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.16 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@1.1.16 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.16 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.16 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.16 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@1.1.16 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.16 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@5.0.7 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.7 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@5.0.7 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.7 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@5.0.7 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.7 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@5.0.7 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.7 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-j22f-vq7h-c4qm","severity":"high","message":"devalue@5.8.1 (npm) is affected by GHSA-j22f-vq7h-c4qm","path":"package-lock.json","line":null,"fingerprint":"devalue@5.8.1 (npm):GHSA-j22f-vq7h-c4qm"},{"rule_id":"osv/GHSA-mcm9-63f2-9j32","severity":"high","message":"devalue@5.8.1 (npm) is affected by GHSA-mcm9-63f2-9j32","path":"package-lock.json","line":null,"fingerprint":"devalue@5.8.1 (npm):GHSA-mcm9-63f2-9j32"},{"rule_id":"osv/GHSA-r9w8-h9r3-54w4","severity":"high","message":"devalue@5.8.1 (npm) is affected by GHSA-r9w8-h9r3-54w4","path":"package-lock.json","line":null,"fingerprint":"devalue@5.8.1 (npm):GHSA-r9w8-h9r3-54w4"},{"rule_id":"osv/GHSA-x5rw-q4pp-hg5g","severity":"high","message":"devalue@5.8.1 (npm) is affected by GHSA-x5rw-q4pp-hg5g","path":"package-lock.json","line":null,"fingerprint":"devalue@5.8.1 (npm):GHSA-x5rw-q4pp-hg5g"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@3.14.1 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"package-lock.json","line":null,"fingerprint":"js-yaml@3.14.1 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-52cp-r559-cp3m","severity":"high","message":"js-yaml@3.14.1 (npm) is affected by GHSA-52cp-r559-cp3m","path":"package-lock.json","line":null,"fingerprint":"js-yaml@3.14.1 (npm):GHSA-52cp-r559-cp3m"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@3.14.1 (npm) is affected by GHSA-5p4m-2wfm-xmqj","path":"package-lock.json","line":null,"fingerprint":"js-yaml@3.14.1 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.3.1 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.3.1 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.16 (npm) is affected by GHSA-2v37-7h3g-55p8","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.16 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-f88m-g3jw-g9cj","severity":"high","message":"sharp@0.34.2 (npm) is affected by GHSA-f88m-g3jw-g9cj","path":"package-lock.json","line":null,"fingerprint":"sharp@0.34.2 (npm):GHSA-f88m-g3jw-g9cj"},{"rule_id":"osv/GHSA-rgj7-g3m4-5g8c","severity":"high","message":"sharp@0.34.2 (npm) is affected by GHSA-rgj7-g3m4-5g8c","path":"package-lock.json","line":null,"fingerprint":"sharp@0.34.2 (npm):GHSA-rgj7-g3m4-5g8c"},{"rule_id":"osv/GHSA-wq5f-xc86-pv6w","severity":"high","message":"sharp@0.34.2 (npm) is affected by GHSA-wq5f-xc86-pv6w","path":"package-lock.json","line":null,"fingerprint":"sharp@0.34.2 (npm):GHSA-wq5f-xc86-pv6w"},{"rule_id":"osv/GHSA-7w5x-hrqm-74c2","severity":"high","message":"smol-toml@1.6.1 (npm) is affected by GHSA-7w5x-hrqm-74c2","path":"package-lock.json","line":null,"fingerprint":"smol-toml@1.6.1 (npm):GHSA-7w5x-hrqm-74c2"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-w27v-7q3p-w38r","severity":"high","message":"svgo@4.0.2 (npm) is affected by GHSA-w27v-7q3p-w38r","path":"package-lock.json","line":null,"fingerprint":"svgo@4.0.2 (npm):GHSA-w27v-7q3p-w38r"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@7.3.6 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"package-lock.json","line":null,"fingerprint":"vite@7.3.6 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.4.3 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"package-lock.json","line":null,"fingerprint":"zod@4.4.3 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-p498-v437-472g","severity":"medium","message":"@humanfs/node@0.16.6 (npm) is affected by GHSA-p498-v437-472g","path":"package-lock.json","line":null,"fingerprint":"@humanfs/node@0.16.6 (npm):GHSA-p498-v437-472g"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"@vitest/mocker@3.2.6 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@3.2.6 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-qxg6-89mg-rqv8","severity":"medium","message":"@vitest/mocker@3.2.6 (npm) is affected by GHSA-qxg6-89mg-rqv8","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@3.2.6 (npm):GHSA-qxg6-89mg-rqv8"},{"rule_id":"osv/GHSA-2g4f-4pwh-qvx6","severity":"medium","message":"ajv@6.12.6 (npm) is affected by GHSA-2g4f-4pwh-qvx6","path":"package-lock.json","line":null,"fingerprint":"ajv@6.12.6 (npm):GHSA-2g4f-4pwh-qvx6"},{"rule_id":"osv/GHSA-376h-93r7-7g6f","severity":"medium","message":"astro@6.4.6 (npm) is affected by GHSA-376h-93r7-7g6f","path":"package-lock.json","line":null,"fingerprint":"astro@6.4.6 (npm):GHSA-376h-93r7-7g6f"},{"rule_id":"osv/GHSA-4g3v-8h47-v7g6","severity":"medium","message":"astro@6.4.6 (npm) is affected by GHSA-4g3v-8h47-v7g6","path":"package-lock.json","line":null,"fingerprint":"astro@6.4.6 (npm):GHSA-4g3v-8h47-v7g6"},{"rule_id":"osv/GHSA-98hj-9722-w3j8","severity":"medium","message":"astro@6.4.6 (npm) is affected by GHSA-98hj-9722-w3j8","path":"package-lock.json","line":null,"fingerprint":"astro@6.4.6 (npm):GHSA-98hj-9722-w3j8"},{"rule_id":"osv/GHSA-f48w-9m4c-m7f5","severity":"medium","message":"astro@6.4.6 (npm) is affected by GHSA-f48w-9m4c-m7f5","path":"package-lock.json","line":null,"fingerprint":"astro@6.4.6 (npm):GHSA-f48w-9m4c-m7f5"},{"rule_id":"osv/GHSA-r3h5-4585-7x3w","severity":"medium","message":"astro@6.4.6 (npm) is affected by GHSA-r3h5-4585-7x3w","path":"package-lock.json","line":null,"fingerprint":"astro@6.4.6 (npm):GHSA-r3h5-4585-7x3w"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.16 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.16 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@5.0.7 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@5.0.7 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-4q55-j62x-fr9h","severity":"medium","message":"devalue@5.8.1 (npm) is affected by GHSA-4q55-j62x-fr9h","path":"package-lock.json","line":null,"fingerprint":"devalue@5.8.1 (npm):GHSA-4q55-j62x-fr9h"},{"rule_id":"osv/GHSA-9rgm-9g3h-6x36","severity":"medium","message":"devalue@5.8.1 (npm) is affected by GHSA-9rgm-9g3h-6x36","path":"package-lock.json","line":null,"fingerprint":"devalue@5.8.1 (npm):GHSA-9rgm-9g3h-6x36"},{"rule_id":"osv/GHSA-hx4r-w6wj-j8fg","severity":"medium","message":"devalue@5.8.1 (npm) is affected by GHSA-hx4r-w6wj-j8fg","path":"package-lock.json","line":null,"fingerprint":"devalue@5.8.1 (npm):GHSA-hx4r-w6wj-j8fg"},{"rule_id":"osv/GHSA-3g3m-2fjr-6pw4","severity":"medium","message":"glob@11.1.0 (npm) is affected by GHSA-3g3m-2fjr-6pw4","path":"package-lock.json","line":null,"fingerprint":"glob@11.1.0 (npm):GHSA-3g3m-2fjr-6pw4"},{"rule_id":"osv/GHSA-h67p-54hq-rp68","severity":"medium","message":"js-yaml@3.14.1 (npm) is affected by GHSA-h67p-54hq-rp68","path":"package-lock.json","line":null,"fingerprint":"js-yaml@3.14.1 (npm):GHSA-h67p-54hq-rp68"},{"rule_id":"osv/GHSA-mh29-5h37-fv8m","severity":"medium","message":"js-yaml@3.14.1 (npm) is affected by GHSA-mh29-5h37-fv8m","path":"package-lock.json","line":null,"fingerprint":"js-yaml@3.14.1 (npm):GHSA-mh29-5h37-fv8m"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@10.2.5 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@10.2.5 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-r4xh-jqrq-34v2","severity":"medium","message":"smol-toml@1.6.1 (npm) is affected by GHSA-r4xh-jqrq-34v2","path":"package-lock.json","line":null,"fingerprint":"smol-toml@1.6.1 (npm):GHSA-r4xh-jqrq-34v2"},{"rule_id":"osv/GHSA-4vpr-x523-8j87","severity":"medium","message":"svgo@4.0.2 (npm) is affected by GHSA-4vpr-x523-8j87","path":"package-lock.json","line":null,"fingerprint":"svgo@4.0.2 (npm):GHSA-4vpr-x523-8j87"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@7.3.6 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"package-lock.json","line":null,"fingerprint":"vite@7.3.6 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@7.3.6 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"package-lock.json","line":null,"fingerprint":"vite@7.3.6 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@7.3.6 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"package-lock.json","line":null,"fingerprint":"vite@7.3.6 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"vitest@3.2.6 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"package-lock.json","line":null,"fingerprint":"vitest@3.2.6 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-xffm-g5w8-qvg7","severity":"low","message":"@eslint/plugin-kit@0.3.1 (npm) is affected by GHSA-xffm-g5w8-qvg7","path":"package-lock.json","line":null,"fingerprint":"@eslint/plugin-kit@0.3.1 (npm):GHSA-xffm-g5w8-qvg7"},{"rule_id":"osv/GHSA-7pw4-f3q4-r2p2","severity":"low","message":"astro@6.4.6 (npm) is affected by GHSA-7pw4-f3q4-r2p2","path":"package-lock.json","line":null,"fingerprint":"astro@6.4.6 (npm):GHSA-7pw4-f3q4-r2p2"},{"rule_id":"osv/GHSA-mh32-jxcr-mh9f","severity":"low","message":"astro@6.4.6 (npm) is affected by GHSA-mh32-jxcr-mh9f","path":"package-lock.json","line":null,"fingerprint":"astro@6.4.6 (npm):GHSA-mh32-jxcr-mh9f"},{"rule_id":"osv/GHSA-wf3x-273g-mvxv","severity":"low","message":"devalue@5.8.1 (npm) is affected by GHSA-wf3x-273g-mvxv","path":"package-lock.json","line":null,"fingerprint":"devalue@5.8.1 (npm):GHSA-wf3x-273g-mvxv"},{"rule_id":"osv/GHSA-g7r4-m6w7-qqqr","severity":"low","message":"esbuild@0.27.7 (npm) is affected by GHSA-g7r4-m6w7-qqqr","path":"package-lock.json","line":null,"fingerprint":"esbuild@0.27.7 (npm):GHSA-g7r4-m6w7-qqqr"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@7.3.6 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"package-lock.json","line":null,"fingerprint":"vite@7.3.6 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":4.0,"findings":8.0,"findings_high":5.0,"findings_medium":3.0,"findings_low":0.0,"penalty":64.8},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/deploy-production.yml","line":10,"fingerprint":"unpinned-uses:.github/workflows/deploy-production.yml:10"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/label.yml","line":20,"fingerprint":"unpinned-uses:.github/workflows/label.yml:20"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/stale.yml","line":21,"fingerprint":"unpinned-uses:.github/workflows/stale.yml:21"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":17,"fingerprint":"unpinned-uses:.github/workflows/test.yml:17"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":19,"fingerprint":"unpinned-uses:.github/workflows/test.yml:19"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/deploy-production.yml","line":10,"fingerprint":"artipacked:.github/workflows/deploy-production.yml:10"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/deploy-production.yml","line":7,"fingerprint":"excessive-permissions:.github/workflows/deploy-production.yml:7"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":17,"fingerprint":"artipacked:.github/workflows/test.yml:17"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":0.865,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: SECURITY.md","ref":"SECURITY.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":512.0,"function_nloc":3258.0,"mean_ccn":1.84,"p90_ccn":3.0,"complex_functions":3.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0378},"findings":[],"evidence":[{"kind":"complex-function","description":"stem in src/lib/search/porterStemmer.js: complexity 29, 47 lines","ref":"src/lib/search/porterStemmer.js","url":"https://github.com/Chalarangelo/30-seconds-of-code/blob/bd756f8b2283a38560efe83cb30af38324d4e9e9/src/lib/search/porterStemmer.js#L74","weight":0.48333333333333334},{"kind":"complex-function","description":"(anonymous) in src/presenters/recommendationPresenter.js: complexity 19, 60 lines","ref":"src/presenters/recommendationPresenter.js","url":"https://github.com/Chalarangelo/30-seconds-of-code/blob/bd756f8b2283a38560efe83cb30af38324d4e9e9/src/presenters/recommendationPresenter.js#L84","weight":0.31666666666666665},{"kind":"complex-function","description":"tokenFilter in src/lib/search/server.js: complexity 18, 16 lines","ref":"src/lib/search/server.js","url":"https://github.com/Chalarangelo/30-seconds-of-code/blob/bd756f8b2283a38560efe83cb30af38324d4e9e9/src/lib/search/server.js#L25","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":5957.0,"duplicated_lines":30.0,"duplicated_share":0.005,"files":87.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: src/models/collection.js:10 and src/models/snippet.js:13","ref":"src/models/collection.js","url":"https://github.com/Chalarangelo/30-seconds-of-code/blob/bd756f8b2283a38560efe83cb30af38324d4e9e9/src/models/collection.js#L10","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":2.0,"weighted_findings":0.5,"scanned_lines":7911.0,"category:correctness":2.0},"findings":[{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/lib/contentUtils/componentCreator.js","line":24,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/lib/contentUtils/componentCreator.js:24"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/lib/contentUtils/componentCreator.js","line":24,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/lib/contentUtils/componentCreator.js:24"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.4609,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.3125,"test_lines":1823.0,"source_lines":7911.0,"test_ratio":0.2304,"ci_files":4.0,"cochange_share":0.0781,"cochange_commits":64.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/deploy-production.yml","ref":".github/workflows/deploy-production.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/label.yml","ref":".github/workflows/label.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/stale.yml","ref":".github/workflows/stale.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/test.yml","ref":".github/workflows/test.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":17.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":0.0,"other_lines":7911.0,"files_blamed":87.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:other_findings":2.0,"quality:other_per_kloc":0.253,"security:ai_findings":0.0,"security:other_findings":36.0,"security:other_per_kloc":4.551},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}