{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:00.196515Z","repo":{"ref":{"host":"github.com","owner":"ChanOoDev","name":"specflow-lite"},"default_branch":"main","clone_url":"https://github.com/ChanOoDev/specflow-lite.git","html_url":"https://github.com/ChanOoDev/specflow-lite","description":"specflow-lite","stars":4,"forks":1,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":5212,"primary_language":"TypeScript","license_spdx":"MIT","created_at":"2026-06-15T07:21:39Z","pushed_at":"2026-07-25T17:06:35Z","security_policy_url":null,"distribution":{"owner_created_at":"2022-09-06T01:29:35Z","owner_type":"User","release_assets":[]}},"commit_sha":"bc27dd4bb8be41d73b8d9f1dcf3433d914320221","profile":{"lines_by_language":{"TypeScript":14615,"Shell":1445,"SQL":598,"JavaScript":417,"PowerShell":237},"files_by_category":{"source":133,"docs":97,"test":34,"binary":23,"config":22,"generated":1,"other":1},"source_lines":13483,"test_lines":3829},"pillars":{"ai_provenance":{"score":93.0,"confidence":0.85,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.93,"suspected_share":0.0,"estimated_share":0.93,"ai_artifacts":29.0,"flagged_work_units":4.0,"flagged_releases":null,"style_index":0.482},"summary":"Explicit AI attribution on 93% of first-party code added; an estimated 93% including velocity signals."},"quality":{"score":55.6,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":69.7,"duplication":30.0,"lint":65.7,"testing":40.9,"docs":65.0,"type_safety":100.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.28, no CI test run detected; 12% of function code in complex or long functions; 20% duplicated lines. Weakest area: duplication."},"security":{"score":55.9,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":96.7,"sast":70.6,"dependencies":18.0,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 76 known vulnerabilities in 13 dependencies. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":23.0,"checked":23.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":61.0,"attributed_commits":44.0,"attributed_commit_share":0.7213114754098361,"effective_loc":18050.0,"attributed_loc":16787.0,"attributed_loc_share":0.9300277008310249,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 44 attributed commits, 16,787 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"86c37598cebd307180cc92939052ce2e848af08c","url":"https://github.com/ChanOoDev/specflow-lite/commit/86c37598cebd307180cc92939052ce2e848af08c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d6977770b8c3f46cb6ac1e25525abf2d0e06a37f","url":"https://github.com/ChanOoDev/specflow-lite/commit/d6977770b8c3f46cb6ac1e25525abf2d0e06a37f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ed68e62d71b7ee7f9818aef98d1f15e50592e879","url":"https://github.com/ChanOoDev/specflow-lite/commit/ed68e62d71b7ee7f9818aef98d1f15e50592e879","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3da36d1c357e9ea20c351ef9d008ad6dbd09758f","url":"https://github.com/ChanOoDev/specflow-lite/commit/3da36d1c357e9ea20c351ef9d008ad6dbd09758f","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"c564d421653e7e621f17c7a01577ad05cdd69d39","url":"https://github.com/ChanOoDev/specflow-lite/commit/c564d421653e7e621f17c7a01577ad05cdd69d39","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"241703f56d7697d95cc67dbd58dcf8cf98245450","url":"https://github.com/ChanOoDev/specflow-lite/commit/241703f56d7697d95cc67dbd58dcf8cf98245450","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d68c038234e8c463c4370682b7a79cb7020b22bc","url":"https://github.com/ChanOoDev/specflow-lite/commit/d68c038234e8c463c4370682b7a79cb7020b22bc","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d8c21b070535760fb9d3226c88740df3a97dcc67","url":"https://github.com/ChanOoDev/specflow-lite/commit/d8c21b070535760fb9d3226c88740df3a97dcc67","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1a76d555fdad0b58907b23be79eda51f75526d70","url":"https://github.com/ChanOoDev/specflow-lite/commit/1a76d555fdad0b58907b23be79eda51f75526d70","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"4d725eaaa88131c443f9d4fba1a919d16fc5c9ab","url":"https://github.com/ChanOoDev/specflow-lite/commit/4d725eaaa88131c443f9d4fba1a919d16fc5c9ab","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"b2c7f36eb7dbff4d102d82345f87bec1c873e4e0","url":"https://github.com/ChanOoDev/specflow-lite/commit/b2c7f36eb7dbff4d102d82345f87bec1c873e4e0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f5ae1f024695b7adcd9201ef7ae9d1bbe73a72a2","url":"https://github.com/ChanOoDev/specflow-lite/commit/f5ae1f024695b7adcd9201ef7ae9d1bbe73a72a2","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"8daaa3a5b7fca9e3016b7ad4fc8781c95d85eace","url":"https://github.com/ChanOoDev/specflow-lite/commit/8daaa3a5b7fca9e3016b7ad4fc8781c95d85eace","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3c87fa5748a713dad81293f9d977c5898c33431d","url":"https://github.com/ChanOoDev/specflow-lite/commit/3c87fa5748a713dad81293f9d977c5898c33431d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"13a22e2bfea36603d6f64b206483a6b9e1d07e29","url":"https://github.com/ChanOoDev/specflow-lite/commit/13a22e2bfea36603d6f64b206483a6b9e1d07e29","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"c97a5158bb44c1973badade37db559c3f2ed70c1","url":"https://github.com/ChanOoDev/specflow-lite/commit/c97a5158bb44c1973badade37db559c3f2ed70c1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"c93d9ac5b4a0a243337babb720cae9b742ce4794","url":"https://github.com/ChanOoDev/specflow-lite/commit/c93d9ac5b4a0a243337babb720cae9b742ce4794","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1edfa545c371497d2952953ddb9c92d1a208b294","url":"https://github.com/ChanOoDev/specflow-lite/commit/1edfa545c371497d2952953ddb9c92d1a208b294","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"489c140f11f5514b77914eb26d488c5333afa7ca","url":"https://github.com/ChanOoDev/specflow-lite/commit/489c140f11f5514b77914eb26d488c5333afa7ca","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d87462eab99bc22bf5c7180b2206fe47b2041222","url":"https://github.com/ChanOoDev/specflow-lite/commit/d87462eab99bc22bf5c7180b2206fe47b2041222","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"b623befd3f6088e76c96b24444b9d58fdad17afd","url":"https://github.com/ChanOoDev/specflow-lite/commit/b623befd3f6088e76c96b24444b9d58fdad17afd","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3c7ab820b9a5c4b607d36915d7905f3fe483e220","url":"https://github.com/ChanOoDev/specflow-lite/commit/3c7ab820b9a5c4b607d36915d7905f3fe483e220","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"172d966190b41b366307014dbe892d4504c96767","url":"https://github.com/ChanOoDev/specflow-lite/commit/172d966190b41b366307014dbe892d4504c96767","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"dda27ed8562e5d5feb8e05d78538c68d8675ee08","url":"https://github.com/ChanOoDev/specflow-lite/commit/dda27ed8562e5d5feb8e05d78538c68d8675ee08","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3607e1c3b3882a2e4edc3affb77dacc777e15ae9","url":"https://github.com/ChanOoDev/specflow-lite/commit/3607e1c3b3882a2e4edc3affb77dacc777e15ae9","weight":0.9}],"data":{"attributed_loc_by_commit":{"8e25e56c5a6eb81d81171b842dd05d0784538f45":4553,"04d7d5fb149e0f069d98681f6c09db7004b6029c":3153,"348e6f72789e5e1e3d407586a7c0ca194e7b08cf":24,"fc45269e67701c091e0193a9955dfaf7a2138f40":35,"9fbd79d89b47916de21ac83a54663bc2c0b537be":0,"51d484b705f2b1a1f3b58c9985ad06e800874eed":0,"0be21510a5d46c76d56e0eb4f7d73a2013faffa3":3297,"8acdd27bbf0357af8b8a65ce0ff809525b44f199":1,"76c95fda0e30652e6bd145d8d05bdfb2a3defe7a":92,"4f6912b916980f9df981116ad323e2da7b41e872":2878,"166f297eacb716cfddd7a2af248033e1f3529ecc":144,"0c1b8237b736da9b47d618633c394e6eb515754e":1027,"140e45deef1f53dd6b6b53dc0725666d326039d4":490,"5d02d33b73041269042e4e74404610b2baba30f4":109,"86e422b27b9cb5192b01ea3421737529307ccb94":0,"18cee6fdc94c6073a9d38cb38df967c30dc8b37a":40,"88b23b81a6cdc2215d754b9275b8b9c8fea473a1":22,"3a75ae035da0e6a4376433ff08b6c61b51c87dee":14,"8a06d7e3596bcea8121694b81118027613872cc9":24,"3607e1c3b3882a2e4edc3affb77dacc777e15ae9":34,"dda27ed8562e5d5feb8e05d78538c68d8675ee08":31,"172d966190b41b366307014dbe892d4504c96767":178,"3c7ab820b9a5c4b607d36915d7905f3fe483e220":30,"b623befd3f6088e76c96b24444b9d58fdad17afd":4,"d87462eab99bc22bf5c7180b2206fe47b2041222":3,"489c140f11f5514b77914eb26d488c5333afa7ca":1,"1edfa545c371497d2952953ddb9c92d1a208b294":0,"c93d9ac5b4a0a243337babb720cae9b742ce4794":0,"c97a5158bb44c1973badade37db559c3f2ed70c1":0,"13a22e2bfea36603d6f64b206483a6b9e1d07e29":0,"3c87fa5748a713dad81293f9d977c5898c33431d":0,"8daaa3a5b7fca9e3016b7ad4fc8781c95d85eace":0,"f5ae1f024695b7adcd9201ef7ae9d1bbe73a72a2":0,"b2c7f36eb7dbff4d102d82345f87bec1c873e4e0":0,"4d725eaaa88131c443f9d4fba1a919d16fc5c9ab":0,"1a76d555fdad0b58907b23be79eda51f75526d70":0,"d8c21b070535760fb9d3226c88740df3a97dcc67":0,"d68c038234e8c463c4370682b7a79cb7020b22bc":0,"241703f56d7697d95cc67dbd58dcf8cf98245450":0,"c564d421653e7e621f17c7a01577ad05cdd69d39":0,"3da36d1c357e9ea20c351ef9d008ad6dbd09758f":0,"ed68e62d71b7ee7f9818aef98d1f15e50592e879":596,"d6977770b8c3f46cb6ac1e25525abf2d0e06a37f":1,"86c37598cebd307180cc92939052ce2e848af08c":6},"tools":{"claude-code":{"name":"Claude Code","commits":44,"loc":16787,"first_seen":1781686179,"last_seen":1784996171}},"monthly":{"2026-06":{"loc":17033,"attributed_loc":16184},"2026-07":{"loc":1017,"attributed_loc":603}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":29.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1781508574.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":".claude/agents/architect-agent.md (claude-code configuration)","ref":".claude/agents/architect-agent.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/agents/architect-agent.md","weight":0.5},{"kind":"ai-artifact","description":".claude/agents/ba-agent.md (claude-code configuration)","ref":".claude/agents/ba-agent.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/agents/ba-agent.md","weight":0.5},{"kind":"ai-artifact","description":".claude/agents/developer-agent.md (claude-code configuration)","ref":".claude/agents/developer-agent.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/agents/developer-agent.md","weight":0.5},{"kind":"ai-artifact","description":".claude/agents/qa-agent.md (claude-code configuration)","ref":".claude/agents/qa-agent.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/agents/qa-agent.md","weight":0.5},{"kind":"ai-artifact","description":".claude/agents/reviewer-agent.md (claude-code configuration)","ref":".claude/agents/reviewer-agent.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/agents/reviewer-agent.md","weight":0.5},{"kind":"ai-artifact","description":".claude/agents/security-agent.md (claude-code configuration)","ref":".claude/agents/security-agent.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/agents/security-agent.md","weight":0.5},{"kind":"ai-artifact","description":".claude/hooks/swarmvault-graph-first.js (claude-code configuration)","ref":".claude/hooks/swarmvault-graph-first.js","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/hooks/swarmvault-graph-first.js","weight":0.5},{"kind":"ai-artifact","description":".claude/settings.json (claude-code configuration)","ref":".claude/settings.json","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/settings.json","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/architect-skill.md (claude-code configuration)","ref":".claude/skills/architect-skill.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/architect-skill.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/ba-skill.md (claude-code configuration)","ref":".claude/skills/ba-skill.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/ba-skill.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/frontend-design/LICENSE.txt (claude-code configuration)","ref":".claude/skills/frontend-design/LICENSE.txt","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/frontend-design/LICENSE.txt","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/frontend-design/SKILL.md (claude-code configuration)","ref":".claude/skills/frontend-design/SKILL.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/frontend-design/SKILL.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/qa-skill.md (claude-code configuration)","ref":".claude/skills/qa-skill.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/qa-skill.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/reviewer-skill.md (claude-code configuration)","ref":".claude/skills/reviewer-skill.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/reviewer-skill.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/security-review-skill.md (claude-code configuration)","ref":".claude/skills/security-review-skill.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/security-review-skill.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/spec-kit-skill.md (claude-code configuration)","ref":".claude/skills/spec-kit-skill.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/spec-kit-skill.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/speckit-agent-context-update/SKILL.md (claude-code configuration)","ref":".claude/skills/speckit-agent-context-update/SKILL.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/speckit-agent-context-update/SKILL.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/speckit-analyze/SKILL.md (claude-code configuration)","ref":".claude/skills/speckit-analyze/SKILL.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/speckit-analyze/SKILL.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/speckit-checklist/SKILL.md (claude-code configuration)","ref":".claude/skills/speckit-checklist/SKILL.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/speckit-checklist/SKILL.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/speckit-clarify/SKILL.md (claude-code configuration)","ref":".claude/skills/speckit-clarify/SKILL.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/speckit-clarify/SKILL.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/speckit-constitution/SKILL.md (claude-code configuration)","ref":".claude/skills/speckit-constitution/SKILL.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/speckit-constitution/SKILL.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/speckit-implement/SKILL.md (claude-code configuration)","ref":".claude/skills/speckit-implement/SKILL.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/speckit-implement/SKILL.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/speckit-plan/SKILL.md (claude-code configuration)","ref":".claude/skills/speckit-plan/SKILL.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/speckit-plan/SKILL.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/speckit-specify/SKILL.md (claude-code configuration)","ref":".claude/skills/speckit-specify/SKILL.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/speckit-specify/SKILL.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/speckit-tasks/SKILL.md (claude-code configuration)","ref":".claude/skills/speckit-tasks/SKILL.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/speckit-tasks/SKILL.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/speckit-taskstoissues/SKILL.md (claude-code configuration)","ref":".claude/skills/speckit-taskstoissues/SKILL.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/speckit-taskstoissues/SKILL.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/swarmvault/SKILL.md (claude-code configuration)","ref":".claude/skills/swarmvault/SKILL.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/swarmvault/SKILL.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/ux-skill.md (claude-code configuration)","ref":".claude/skills/ux-skill.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.claude/skills/ux-skill.md","weight":0.5},{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/CLAUDE.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":".claude/agents/architect-agent.md","added_at":1781519898},{"tool":"claude-code","path":".claude/agents/ba-agent.md","added_at":1781519898},{"tool":"claude-code","path":".claude/agents/developer-agent.md","added_at":1781686179},{"tool":"claude-code","path":".claude/agents/qa-agent.md","added_at":1781519898},{"tool":"claude-code","path":".claude/agents/reviewer-agent.md","added_at":1781519898},{"tool":"claude-code","path":".claude/agents/security-agent.md","added_at":1781519898},{"tool":"claude-code","path":".claude/hooks/swarmvault-graph-first.js","added_at":1781510888},{"tool":"claude-code","path":".claude/settings.json","added_at":1781510888},{"tool":"claude-code","path":".claude/skills/architect-skill.md","added_at":1781518568},{"tool":"claude-code","path":".claude/skills/ba-skill.md","added_at":1781518568},{"tool":"claude-code","path":".claude/skills/frontend-design/LICENSE.txt","added_at":1783601706},{"tool":"claude-code","path":".claude/skills/frontend-design/SKILL.md","added_at":1783601706},{"tool":"claude-code","path":".claude/skills/qa-skill.md","added_at":1781518568},{"tool":"claude-code","path":".claude/skills/reviewer-skill.md","added_at":1781518568},{"tool":"claude-code","path":".claude/skills/security-review-skill.md","added_at":1781519898},{"tool":"claude-code","path":".claude/skills/spec-kit-skill.md","added_at":1781519451},{"tool":"claude-code","path":".claude/skills/speckit-agent-context-update/SKILL.md","added_at":1781686179},{"tool":"claude-code","path":".claude/skills/speckit-analyze/SKILL.md","added_at":1781686179},{"tool":"claude-code","path":".claude/skills/speckit-checklist/SKILL.md","added_at":1781686179},{"tool":"claude-code","path":".claude/skills/speckit-clarify/SKILL.md","added_at":1781686179},{"tool":"claude-code","path":".claude/skills/speckit-constitution/SKILL.md","added_at":1781686179},{"tool":"claude-code","path":".claude/skills/speckit-implement/SKILL.md","added_at":1781686179},{"tool":"claude-code","path":".claude/skills/speckit-plan/SKILL.md","added_at":1781686179},{"tool":"claude-code","path":".claude/skills/speckit-specify/SKILL.md","added_at":1781686179},{"tool":"claude-code","path":".claude/skills/speckit-tasks/SKILL.md","added_at":1781686179},{"tool":"claude-code","path":".claude/skills/speckit-taskstoissues/SKILL.md","added_at":1781686179},{"tool":"claude-code","path":".claude/skills/swarmvault/SKILL.md","added_at":1781510888},{"tool":"claude-code","path":".claude/skills/ux-skill.md","added_at":1781519451},{"tool":"claude-code","path":"CLAUDE.md","added_at":1781508574}],"workflows":[],"tools":["claude-code"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":14.0,"flagged_units":4.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":13497.0,"flagged_loc":10592.0,"flagged_loc_share":0.7847669852559828,"max_loc_per_hour":1761.0389610389611,"median_loc_per_hour":285.066037735849,"pr_timed_units":0.0,"excluded_import_loc":4553.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"3,390 lines of first-party code in ~1.9h (1,761 lines/hour, 3 commit session)","ref":"76c95fda0e30652e6bd145d8d05bdfb2a3defe7a","url":"https://github.com/ChanOoDev/specflow-lite/commit/76c95fda0e30652e6bd145d8d05bdfb2a3defe7a","weight":0.5283116883116883},{"kind":"velocity-burst","description":"3,022 lines of first-party code in ~1.8h (1,654 lines/hour, 2 commit session)","ref":"166f297eacb716cfddd7a2af248033e1f3529ecc","url":"https://github.com/ChanOoDev/specflow-lite/commit/166f297eacb716cfddd7a2af248033e1f3529ecc","weight":0.4961629674673153},{"kind":"velocity-burst","description":"1,027 lines of first-party code in ~1.0h (995 lines/hour, 1 commit session)","ref":"0c1b8237b736da9b47d618633c394e6eb515754e","url":"https://github.com/ChanOoDev/specflow-lite/commit/0c1b8237b736da9b47d618633c394e6eb515754e","weight":0.2984019370460048},{"kind":"velocity-burst","description":"3,153 lines of first-party code in ~4.0h (788 lines/hour, 1 commit session)","ref":"04d7d5fb149e0f069d98681f6c09db7004b6029c","url":"https://github.com/ChanOoDev/specflow-lite/commit/04d7d5fb149e0f069d98681f6c09db7004b6029c","weight":0.236475}],"data":{"flagged_loc_by_commit":{"04d7d5fb149e0f069d98681f6c09db7004b6029c":3153,"0be21510a5d46c76d56e0eb4f7d73a2013faffa3":3297,"8acdd27bbf0357af8b8a65ce0ff809525b44f199":1,"76c95fda0e30652e6bd145d8d05bdfb2a3defe7a":92,"4f6912b916980f9df981116ad323e2da7b41e872":2878,"166f297eacb716cfddd7a2af248033e1f3529ecc":144,"0c1b8237b736da9b47d618633c394e6eb515754e":1027},"excluded_import_commits":["8e25e56c5a6eb81d81171b842dd05d0784538f45"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":13483.0,"index":0.482,"count:narrated_steps":1.0,"per_kloc:narrated_steps":0.074,"files:narrated_steps":1.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":11.0,"per_kloc:emoji_in_code":0.816,"files:emoji_in_code":1.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # First, look for .specify directory (spec-kit's own marker)","ref":".specify/scripts/bash/common.sh:30","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.specify/scripts/bash/common.sh#L30","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":1.0,"secrets_low_confidence":0.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 8e25e56c5a); removed from the current tree but still retrievable","path":".env.local.example","line":3,"fingerprint":"8e25e56c5a6eb81d81171b842dd05d0784538f45:.env.local.example:generic-api-key:3"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":51.0,"findings_high":0.0,"findings_medium":50.0,"findings_low":1.0,"weighted_findings":12.562,"scanned_lines":12648.0,"parse_errors":2.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":13,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:13"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":13,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:13"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":16,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:16"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":21,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:21"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":21,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:21"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `agentKey` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":25,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:25"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `cwd` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":25,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:25"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":25,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:25"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `agentKey` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":26,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:26"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `cwd` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":26,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:26"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":26,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:26"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `agentKey` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":30,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:30"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `cwd` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":30,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:30"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `name` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":30,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:30"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":46,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:46"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":46,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:46"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":74,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:74"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `cwd` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":86,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:86"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":95,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:95"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":97,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:97"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":100,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:100"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `agentKey` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":104,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:104"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `cwd` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":104,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:104"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `agentKey` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":105,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:105"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `cwd` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":105,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:105"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `agentKey` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":110,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:110"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `cwd` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":110,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:110"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `agentKey` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":118,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:118"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `cwd` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":118,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:118"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `segment` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":177,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:.claude/hooks/swarmvault-graph-first.js:177"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":181,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:181"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":181,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:181"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":183,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:183"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":183,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:183"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":183,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:183"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":183,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:183"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `input` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":194,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:194"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `cwd` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":206,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:206"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":206,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:206"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":217,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:217"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `cwd` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":223,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:223"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":223,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:223"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `cwd` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":231,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:.claude/hooks/swarmvault-graph-first.js:231"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":231,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:231"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":254,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:254"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":254,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:254"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":256,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:256"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":256,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:256"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":256,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:256"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":".claude/hooks/swarmvault-graph-first.js","line":256,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:.claude/hooks/swarmvault-graph-first.js:256"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"app/api/projects/[projectId]/specifications/route.ts","line":197,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:app/api/projects/[projectId]/specifications/route.ts:197"}],"evidence":[],"data":{"rulesets":["typescript","javascript","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":13.0,"vulnerabilities":76.0,"vulns_critical":6.0,"vulns_high":28.0,"vulns_medium":34.0,"vulns_low":6.0,"vulns_unknown":2.0,"penalty":103.0},"findings":[{"rule_id":"osv/GHSA-cg2g-xh64-v4q7","severity":"critical","message":"dompurify@3.4.12 (npm) is affected by GHSA-cg2g-xh64-v4q7","path":"package-lock.json","line":null,"fingerprint":"dompurify@3.4.12 (npm):GHSA-cg2g-xh64-v4q7"},{"rule_id":"osv/GHSA-2464-fhr4-w9xw","severity":"critical","message":"next@16.2.9 (npm) is affected by GHSA-2464-fhr4-w9xw","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-2464-fhr4-w9xw"},{"rule_id":"osv/GHSA-2xp9-vwfh-vxw4","severity":"critical","message":"next@16.2.9 (npm) is affected by GHSA-2xp9-vwfh-vxw4","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-2xp9-vwfh-vxw4"},{"rule_id":"osv/GHSA-673q-mjm6-r5xr","severity":"critical","message":"next@16.2.9 (npm) is affected by GHSA-673q-mjm6-r5xr","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-673q-mjm6-r5xr"},{"rule_id":"osv/GHSA-p293-qw3h-jr36","severity":"critical","message":"next@16.2.9 (npm) is affected by GHSA-p293-qw3h-jr36","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-p293-qw3h-jr36"},{"rule_id":"osv/GHSA-vcvr-r3jv-pc5j","severity":"critical","message":"next@16.2.9 (npm) is affected by GHSA-vcvr-r3jv-pc5j","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-vcvr-r3jv-pc5j"},{"rule_id":"osv/GHSA-mrv2-3pqr-j5jr","severity":"high","message":"dompurify@3.4.12 (npm) is affected by GHSA-mrv2-3pqr-j5jr","path":"package-lock.json","line":null,"fingerprint":"dompurify@3.4.12 (npm):GHSA-mrv2-3pqr-j5jr"},{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@3.3.12 (npm) is affected by GHSA-28wg-ghj8-5hjv","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.12 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.12 (npm) is affected by GHSA-2v37-7h3g-55p8","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.12 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-6gpp-xcg3-4w24","severity":"high","message":"next@16.2.9 (npm) is affected by GHSA-6gpp-xcg3-4w24","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-6gpp-xcg3-4w24"},{"rule_id":"osv/GHSA-89xv-2m56-2m9x","severity":"high","message":"next@16.2.9 (npm) is affected by GHSA-89xv-2m56-2m9x","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-89xv-2m56-2m9x"},{"rule_id":"osv/GHSA-cjq9-62q9-8jv4","severity":"high","message":"next@16.2.9 (npm) is affected by GHSA-cjq9-62q9-8jv4","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-cjq9-62q9-8jv4"},{"rule_id":"osv/GHSA-m99w-x7hq-7vfj","severity":"high","message":"next@16.2.9 (npm) is affected by GHSA-m99w-x7hq-7vfj","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-m99w-x7hq-7vfj"},{"rule_id":"osv/GHSA-p3m5-59mp-jv5r","severity":"high","message":"next@16.2.9 (npm) is affected by GHSA-p3m5-59mp-jv5r","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-p3m5-59mp-jv5r"},{"rule_id":"osv/GHSA-p9j2-gv94-2wf4","severity":"high","message":"next@16.2.9 (npm) is affected by GHSA-p9j2-gv94-2wf4","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-p9j2-gv94-2wf4"},{"rule_id":"osv/GHSA-6g55-p6wh-862q","severity":"high","message":"postcss@8.4.31 (npm) is affected by GHSA-6g55-p6wh-862q","path":"package-lock.json","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-6g55-p6wh-862q"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.4.31 (npm) is affected by GHSA-r28c-9q8g-f849","path":"package-lock.json","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.5.15 (npm) is affected by GHSA-r28c-9q8g-f849","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.15 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-f88m-g3jw-g9cj","severity":"high","message":"sharp@0.34.5 (npm) is affected by GHSA-f88m-g3jw-g9cj","path":"package-lock.json","line":null,"fingerprint":"sharp@0.34.5 (npm):GHSA-f88m-g3jw-g9cj"},{"rule_id":"osv/GHSA-rgj7-g3m4-5g8c","severity":"high","message":"sharp@0.34.5 (npm) is affected by GHSA-rgj7-g3m4-5g8c","path":"package-lock.json","line":null,"fingerprint":"sharp@0.34.5 (npm):GHSA-rgj7-g3m4-5g8c"},{"rule_id":"osv/GHSA-wq5f-xc86-pv6w","severity":"high","message":"sharp@0.34.5 (npm) is affected by GHSA-wq5f-xc86-pv6w","path":"package-lock.json","line":null,"fingerprint":"sharp@0.34.5 (npm):GHSA-wq5f-xc86-pv6w"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@7.27.2 (npm) is affected by GHSA-2m5v-pch6-74hx","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-4cwx-7wf7-3272","severity":"high","message":"undici@7.27.2 (npm) is affected by GHSA-4cwx-7wf7-3272","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-4cwx-7wf7-3272"},{"rule_id":"osv/GHSA-4w7w-5xrc-9h26","severity":"high","message":"undici@7.27.2 (npm) is affected by GHSA-4w7w-5xrc-9h26","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-4w7w-5xrc-9h26"},{"rule_id":"osv/GHSA-hm92-r4w5-c3mj","severity":"high","message":"undici@7.27.2 (npm) is affected by GHSA-hm92-r4w5-c3mj","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-hm92-r4w5-c3mj"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@7.27.2 (npm) is affected by GHSA-qrxm-fqhp-jwvm","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-rfgv-xxqx-mfg5","severity":"high","message":"undici@7.27.2 (npm) is affected by GHSA-rfgv-xxqx-mfg5","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-rfgv-xxqx-mfg5"},{"rule_id":"osv/GHSA-vmh5-mc38-953g","severity":"high","message":"undici@7.27.2 (npm) is affected by GHSA-vmh5-mc38-953g","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-vmh5-mc38-953g"},{"rule_id":"osv/GHSA-vxpw-j846-p89q","severity":"high","message":"undici@7.27.2 (npm) is affected by GHSA-vxpw-j846-p89q","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-vxpw-j846-p89q"},{"rule_id":"osv/GHSA-w293-vg96-wgc3","severity":"high","message":"undici@7.27.2 (npm) is affected by GHSA-w293-vg96-wgc3","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-w293-vg96-wgc3"},{"rule_id":"osv/GHSA-xjj6-f33q-929c","severity":"high","message":"undici@7.27.2 (npm) is affected by GHSA-xjj6-f33q-929c","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-xjj6-f33q-929c"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@8.0.16 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"package-lock.json","line":null,"fingerprint":"vite@8.0.16 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.4.3 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"package-lock.json","line":null,"fingerprint":"zod@4.4.3 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"@vitest/mocker@4.1.9 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@4.1.9 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-qxg6-89mg-rqv8","severity":"medium","message":"@vitest/mocker@4.1.9 (npm) is affected by GHSA-qxg6-89mg-rqv8","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@4.1.9 (npm):GHSA-qxg6-89mg-rqv8"},{"rule_id":"osv/GHSA-w5vr-8v7q-w6rv","severity":"medium","message":"baseline-browser-mapping@2.10.37 (npm) is affected by GHSA-w5vr-8v7q-w6rv","path":"package-lock.json","line":null,"fingerprint":"baseline-browser-mapping@2.10.37 (npm):GHSA-w5vr-8v7q-w6rv"},{"rule_id":"osv/GHSA-55q2-fjhq-7xh7","severity":"medium","message":"dompurify@3.4.12 (npm) is affected by GHSA-55q2-fjhq-7xh7","path":"package-lock.json","line":null,"fingerprint":"dompurify@3.4.12 (npm):GHSA-55q2-fjhq-7xh7"},{"rule_id":"osv/GHSA-6688-9rhm-gjv2","severity":"medium","message":"dompurify@3.4.12 (npm) is affected by GHSA-6688-9rhm-gjv2","path":"package-lock.json","line":null,"fingerprint":"dompurify@3.4.12 (npm):GHSA-6688-9rhm-gjv2"},{"rule_id":"osv/GHSA-c6gr-qvv4-5v3f","severity":"medium","message":"dompurify@3.4.12 (npm) is affected by GHSA-c6gr-qvv4-5v3f","path":"package-lock.json","line":null,"fingerprint":"dompurify@3.4.12 (npm):GHSA-c6gr-qvv4-5v3f"},{"rule_id":"osv/GHSA-39w2-rjm5-chcv","severity":"medium","message":"next@16.2.9 (npm) is affected by GHSA-39w2-rjm5-chcv","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-39w2-rjm5-chcv"},{"rule_id":"osv/GHSA-4633-3j49-mh5q","severity":"medium","message":"next@16.2.9 (npm) is affected by GHSA-4633-3j49-mh5q","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-4633-3j49-mh5q"},{"rule_id":"osv/GHSA-4c39-4ccg-62r3","severity":"medium","message":"next@16.2.9 (npm) is affected by GHSA-4c39-4ccg-62r3","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-4c39-4ccg-62r3"},{"rule_id":"osv/GHSA-4jqv-mc3x-m676","severity":"medium","message":"next@16.2.9 (npm) is affected by GHSA-4jqv-mc3x-m676","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-4jqv-mc3x-m676"},{"rule_id":"osv/GHSA-68g3-v927-f742","severity":"medium","message":"next@16.2.9 (npm) is affected by GHSA-68g3-v927-f742","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-68g3-v927-f742"},{"rule_id":"osv/GHSA-955p-x3mx-jcvp","severity":"medium","message":"next@16.2.9 (npm) is affected by GHSA-955p-x3mx-jcvp","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-955p-x3mx-jcvp"},{"rule_id":"osv/GHSA-f87g-xv8r-7p7x","severity":"medium","message":"next@16.2.9 (npm) is affected by GHSA-f87g-xv8r-7p7x","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-f87g-xv8r-7p7x"},{"rule_id":"osv/GHSA-mcj8-r9mp-w47p","severity":"medium","message":"next@16.2.9 (npm) is affected by GHSA-mcj8-r9mp-w47p","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-mcj8-r9mp-w47p"},{"rule_id":"osv/GHSA-q8wf-6r8g-63ch","severity":"medium","message":"next@16.2.9 (npm) is affected by GHSA-q8wf-6r8g-63ch","path":"package-lock.json","line":null,"fingerprint":"next@16.2.9 (npm):GHSA-q8wf-6r8g-63ch"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.4.31 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"package-lock.json","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-qx2v-qp2m-jg93","severity":"medium","message":"postcss@8.4.31 (npm) is affected by GHSA-qx2v-qp2m-jg93","path":"package-lock.json","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-qx2v-qp2m-jg93"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.5.15 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.15 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-2jfj-6hjv-fm6j","severity":"medium","message":"undici@7.27.2 (npm) is affected by GHSA-2jfj-6hjv-fm6j","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-2jfj-6hjv-fm6j"},{"rule_id":"osv/GHSA-3xpg-4rpp-hhhm","severity":"medium","message":"undici@7.27.2 (npm) is affected by GHSA-3xpg-4rpp-hhhm","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-3xpg-4rpp-hhhm"},{"rule_id":"osv/GHSA-4qv8-2p9j-2685","severity":"medium","message":"undici@7.27.2 (npm) is affected by GHSA-4qv8-2p9j-2685","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-4qv8-2p9j-2685"},{"rule_id":"osv/GHSA-55wc-3pg8-jfw6","severity":"medium","message":"undici@7.27.2 (npm) is affected by GHSA-55wc-3pg8-jfw6","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-55wc-3pg8-jfw6"},{"rule_id":"osv/GHSA-8xcm-r25x-g524","severity":"medium","message":"undici@7.27.2 (npm) is affected by GHSA-8xcm-r25x-g524","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-8xcm-r25x-g524"},{"rule_id":"osv/GHSA-9fm3-97px-rjf6","severity":"medium","message":"undici@7.27.2 (npm) is affected by GHSA-9fm3-97px-rjf6","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-9fm3-97px-rjf6"},{"rule_id":"osv/GHSA-f72v-6w45-q472","severity":"medium","message":"undici@7.27.2 (npm) is affected by GHSA-f72v-6w45-q472","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-f72v-6w45-q472"},{"rule_id":"osv/GHSA-jr45-8vmc-qm54","severity":"medium","message":"undici@7.27.2 (npm) is affected by GHSA-jr45-8vmc-qm54","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-jr45-8vmc-qm54"},{"rule_id":"osv/GHSA-m8rv-5g2x-5cg5","severity":"medium","message":"undici@7.27.2 (npm) is affected by GHSA-m8rv-5g2x-5cg5","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-m8rv-5g2x-5cg5"},{"rule_id":"osv/GHSA-p88m-4jfj-68fv","severity":"medium","message":"undici@7.27.2 (npm) is affected by GHSA-p88m-4jfj-68fv","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-p88m-4jfj-68fv"},{"rule_id":"osv/GHSA-pmjh-fq2x-6v4x","severity":"medium","message":"undici@7.27.2 (npm) is affected by GHSA-pmjh-fq2x-6v4x","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-pmjh-fq2x-6v4x"},{"rule_id":"osv/GHSA-pr7r-676h-xcf6","severity":"medium","message":"undici@7.27.2 (npm) is affected by GHSA-pr7r-676h-xcf6","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-pr7r-676h-xcf6"},{"rule_id":"osv/GHSA-rx4f-c7p8-82vq","severity":"medium","message":"undici@7.27.2 (npm) is affected by GHSA-rx4f-c7p8-82vq","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-rx4f-c7p8-82vq"},{"rule_id":"osv/GHSA-v3r7-h72x-cjcm","severity":"medium","message":"undici@7.27.2 (npm) is affected by GHSA-v3r7-h72x-cjcm","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-v3r7-h72x-cjcm"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@8.0.16 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"package-lock.json","line":null,"fingerprint":"vite@8.0.16 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@8.0.16 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"package-lock.json","line":null,"fingerprint":"vite@8.0.16 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@8.0.16 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"package-lock.json","line":null,"fingerprint":"vite@8.0.16 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"vitest@4.1.9 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"package-lock.json","line":null,"fingerprint":"vitest@4.1.9 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-2gqq-gqf2-x968","severity":"low","message":"undici@7.27.2 (npm) is affected by GHSA-2gqq-gqf2-x968","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-2gqq-gqf2-x968"},{"rule_id":"osv/GHSA-35p6-xmwp-9g52","severity":"low","message":"undici@7.27.2 (npm) is affected by GHSA-35p6-xmwp-9g52","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-35p6-xmwp-9g52"},{"rule_id":"osv/GHSA-8436-99hf-9mmv","severity":"low","message":"undici@7.27.2 (npm) is affected by GHSA-8436-99hf-9mmv","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-8436-99hf-9mmv"},{"rule_id":"osv/GHSA-g8m3-5g58-fq7m","severity":"low","message":"undici@7.27.2 (npm) is affected by GHSA-g8m3-5g58-fq7m","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-g8m3-5g58-fq7m"},{"rule_id":"osv/GHSA-r53p-7pc4-xj5r","severity":"low","message":"undici@7.27.2 (npm) is affected by GHSA-r53p-7pc4-xj5r","path":"package-lock.json","line":null,"fingerprint":"undici@7.27.2 (npm):GHSA-r53p-7pc4-xj5r"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@8.0.16 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"package-lock.json","line":null,"fingerprint":"vite@8.0.16 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0164,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":469.0,"function_nloc":7232.0,"mean_ccn":2.91,"p90_ccn":8.0,"complex_functions":5.0,"long_functions":5.0,"many_param_functions":0.0,"risky_nloc_share":0.1202},"findings":[],"evidence":[{"kind":"complex-function","description":"GET in app/api/dashboard/route.ts: complexity 32, 132 lines","ref":"app/api/dashboard/route.ts","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/app/api/dashboard/route.ts#L5","weight":0.5333333333333333},{"kind":"complex-function","description":"PATCH in app/api/projects/[projectId]/specifications/[specificationId]/tasks/[taskId]/route.ts: complexity 31, 152 lines","ref":"app/api/projects/[projectId]/specifications/[specificationId]/tasks/[taskId]/route.ts","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/app/api/projects/[projectId]/specifications/[specificationId]/tasks/[taskId]/route.ts#L66","weight":0.5166666666666667},{"kind":"complex-function","description":"PATCH in app/api/projects/[projectId]/specifications/[specificationId]/route.ts: complexity 28, 180 lines","ref":"app/api/projects/[projectId]/specifications/[specificationId]/route.ts","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/app/api/projects/[projectId]/specifications/[specificationId]/route.ts#L107","weight":0.4666666666666667},{"kind":"complex-function","description":"PATCH in app/api/projects/[projectId]/requirements/[requirementId]/route.ts: complexity 19, 89 lines","ref":"app/api/projects/[projectId]/requirements/[requirementId]/route.ts","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/app/api/projects/[projectId]/requirements/[requirementId]/route.ts#L49","weight":0.31666666666666665},{"kind":"complex-function","description":"PATCH in app/api/projects/[projectId]/route.ts: complexity 17, 75 lines","ref":"app/api/projects/[projectId]/route.ts","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/app/api/projects/[projectId]/route.ts#L66","weight":0.2833333333333333},{"kind":"complex-function","description":"SpecificationDetailPageContent in app/projects/[projectId]/specifications/[specificationId]/page.tsx: complexity 8, 101 lines","ref":"app/projects/[projectId]/specifications/[specificationId]/page.tsx","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/app/projects/[projectId]/specifications/[specificationId]/page.tsx#L27","weight":0.13333333333333333},{"kind":"complex-function","description":"ProjectInfoPage in app/components/project-info/project-info-page.tsx: complexity 1, 140 lines","ref":"app/components/project-info/project-info-page.tsx","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/app/components/project-info/project-info-page.tsx#L234","weight":0.016666666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":9760.0,"duplicated_lines":1958.0,"duplicated_share":0.2006,"files":133.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: .specify/extensions/agent-context/scripts/bash/update-agent-context.sh:54 and .specify/extensions/agent-context/scripts/powershell/update-agent-context.ps1:99","ref":".specify/extensions/agent-context/scripts/bash/update-agent-context.sh","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.specify/extensions/agent-context/scripts/bash/update-agent-context.sh#L54","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: .specify/scripts/bash/check-prerequisites.sh:74 and .specify/scripts/bash/setup-tasks.sh:18","ref":".specify/scripts/bash/check-prerequisites.sh","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.specify/scripts/bash/check-prerequisites.sh#L74","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: .specify/scripts/bash/common.sh:302 and .specify/scripts/bash/common.sh:390","ref":".specify/scripts/bash/common.sh","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/.specify/scripts/bash/common.sh#L302","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/api/projects/[projectId]/archive/route.ts:9 and app/api/projects/[projectId]/requirements/route.ts:102","ref":"app/api/projects/[projectId]/archive/route.ts","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/app/api/projects/[projectId]/archive/route.ts#L9","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/api/projects/[projectId]/archive/route.ts:13 and app/api/projects/[projectId]/route.ts:70","ref":"app/api/projects/[projectId]/archive/route.ts","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/app/api/projects/[projectId]/archive/route.ts#L13","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/api/projects/[projectId]/archive/route.ts:55 and app/api/projects/[projectId]/archive/route.ts:77","ref":"app/api/projects/[projectId]/archive/route.ts","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/app/api/projects/[projectId]/archive/route.ts#L55","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/api/projects/[projectId]/requirements/[requirementId]/route.ts:16 and app/api/projects/[projectId]/requirements/[requirementId]/route.ts:164","ref":"app/api/projects/[projectId]/requirements/[requirementId]/route.ts","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/app/api/projects/[projectId]/requirements/[requirementId]/route.ts#L16","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/api/projects/[projectId]/requirements/[requirementId]/route.ts:60 and app/api/projects/[projectId]/specifications/[specificationId]/route.ts:122","ref":"app/api/projects/[projectId]/requirements/[requirementId]/route.ts","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/app/api/projects/[projectId]/requirements/[requirementId]/route.ts#L60","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/api/projects/[projectId]/requirements/[requirementId]/route.ts:63 and app/api/projects/[projectId]/requirements/route.ts:23","ref":"app/api/projects/[projectId]/requirements/[requirementId]/route.ts","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/app/api/projects/[projectId]/requirements/[requirementId]/route.ts#L63","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: app/api/projects/[projectId]/requirements/[requirementId]/route.ts:101 and app/api/projects/[projectId]/route.ts:95","ref":"app/api/projects/[projectId]/requirements/[requirementId]/route.ts","url":"https://github.com/ChanOoDev/specflow-lite/blob/bc27dd4bb8be41d73b8d9f1dcf3433d914320221/app/api/projects/[projectId]/requirements/[requirementId]/route.ts#L101","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":31.0,"weighted_findings":21.25,"scanned_lines":12648.0,"category:best-practice":15.0,"category:correctness":16.0},"findings":[{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":".claude/hooks/swarmvault-graph-first.js","line":41,"fingerprint":"javascript.lang.correctness.no-replaceall:.claude/hooks/swarmvault-graph-first.js:41"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":".claude/hooks/swarmvault-graph-first.js","line":42,"fingerprint":"javascript.lang.correctness.no-replaceall:.claude/hooks/swarmvault-graph-first.js:42"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":".claude/hooks/swarmvault-graph-first.js","line":175,"fingerprint":"javascript.lang.correctness.no-replaceall:.claude/hooks/swarmvault-graph-first.js:175"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/projects/project-form.tsx","line":88,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/projects/project-form.tsx:88"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/projects/project-form.tsx","line":97,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/projects/project-form.tsx:97"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/projects/project-form.tsx","line":105,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/projects/project-form.tsx:105"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/requirements/requirement-form.tsx","line":119,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/requirements/requirement-form.tsx:119"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/requirements/requirement-form.tsx","line":128,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/requirements/requirement-form.tsx:128"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/requirements/requirement-form.tsx","line":135,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/requirements/requirement-form.tsx:135"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/requirements/requirement-form.tsx","line":142,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/requirements/requirement-form.tsx:142"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/requirements/requirement-form.tsx","line":150,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/requirements/requirement-form.tsx:150"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/specifications/specification-form.tsx","line":101,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/specifications/specification-form.tsx:101"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/specifications/specification-form.tsx","line":110,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/specifications/specification-form.tsx:110"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/specifications/specification-form.tsx","line":127,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/specifications/specification-form.tsx:127"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/tasks/task-form.tsx","line":114,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/tasks/task-form.tsx:114"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/tasks/task-form.tsx","line":123,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/tasks/task-form.tsx:123"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/tasks/task-form.tsx","line":131,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/tasks/task-form.tsx:131"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/tasks/task-form.tsx","line":141,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/tasks/task-form.tsx:141"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":".specify/scripts/bash/check-prerequisites.sh","line":87,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:.specify/scripts/bash/check-prerequisites.sh:87"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":".specify/scripts/bash/check-prerequisites.sh","line":88,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:.specify/scripts/bash/check-prerequisites.sh:88"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":".specify/scripts/bash/check-prerequisites.sh","line":128,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:.specify/scripts/bash/check-prerequisites.sh:128"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":".specify/scripts/bash/check-prerequisites.sh","line":149,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:.specify/scripts/bash/check-prerequisites.sh:149"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":".specify/scripts/bash/check-prerequisites.sh","line":154,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:.specify/scripts/bash/check-prerequisites.sh:154"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":".specify/scripts/bash/check-prerequisites.sh","line":186,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:.specify/scripts/bash/check-prerequisites.sh:186"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":".specify/scripts/bash/setup-plan.sh","line":40,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:.specify/scripts/bash/setup-plan.sh:40"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":".specify/scripts/bash/setup-plan.sh","line":49,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:.specify/scripts/bash/setup-plan.sh:49"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":".specify/scripts/bash/setup-plan.sh","line":55,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:.specify/scripts/bash/setup-plan.sh:55"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":".specify/scripts/bash/setup-plan.sh","line":66,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:.specify/scripts/bash/setup-plan.sh:66"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":".specify/scripts/bash/setup-tasks.sh","line":61,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:.specify/scripts/bash/setup-tasks.sh:61"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"app/layout.tsx","line":28,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:app/layout.tsx:28"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"app/layout.tsx","line":28,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:app/layout.tsx:28"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.568,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.6667,"test_lines":3829.0,"source_lines":13483.0,"test_ratio":0.284,"ci_files":0.0,"cochange_share":0.1667,"cochange_commits":30.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":63.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: tsconfig.json","ref":"tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":12296.0,"other_lines":1187.0,"files_blamed":133.0,"blame_failures":0.0,"quality:ai_findings":26.0,"quality:ai_per_kloc":2.115,"quality:other_findings":5.0,"quality:other_per_kloc":4.212,"quality:ratio":0.5,"security:ai_findings":1.0,"security:ai_per_kloc":0.081,"security:other_findings":50.0,"security:other_per_kloc":42.123,"security:ratio":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":["unreviewed-ai-risk"]}