{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T15:20:08.031453Z","repo":{"ref":{"host":"github.com","owner":"CyC2018","name":"CS-Notes"},"default_branch":"master","clone_url":"https://github.com/CyC2018/CS-Notes.git","html_url":"https://github.com/CyC2018/CS-Notes","description":":books: 技术面试必备基础知识、Leetcode、计算机操作系统、计算机网络、系统设计","stars":186509,"forks":50631,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":261408,"primary_language":"JavaScript","license_spdx":null,"created_at":"2018-02-13T14:56:24Z","pushed_at":"2026-11-14T06:09:00Z","security_policy_url":null,"distribution":{"owner_created_at":"2018-02-08T09:03:31Z","owner_type":"User","release_assets":[]}},"commit_sha":"cb9f180fb26da7b7100fde250a5dd137455b3a02","profile":{"lines_by_language":{"JavaScript":16307,"Python":1220},"files_by_category":{"other":1348,"binary":1269,"vendored":203,"source":198,"docs":195,"config":15,"test":13,"generated":1},"source_lines":16362,"test_lines":1165},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.336},"summary":"Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals."},"quality":{"score":61.7,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":44.9,"duplication":84.7,"lint":85.5,"testing":58.6,"docs":55.0,"type_safety":40.0,"process":50.0},"summary":"Code quality is weak: test-to-source ratio 0.07, CI runs tests; 27% of function code in complex or long functions; 3% duplicated lines. Weakest area: type safety."},"security":{"score":68.0,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":74.1,"sast":50.3,"dependencies":95.1,"ci_actions":100.0,"posture":0.0,"scorecard":54.3},"summary":"Security posture is weak: 1 known vulnerabilities in 1 dependencies; 29 high-severity SAST findings. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"ok","tool_version":"scorecard v5.6.0","metrics":{"aggregate":5.0,"check:Maintained":10.0,"check:Code-Review":0.0,"check:Token-Permissions":10.0,"check:Dangerous-Workflow":10.0,"check:CII-Best-Practices":0.0,"check:Binary-Artifacts":10.0,"check:Security-Policy":0.0,"check:License":0.0,"check:Pinned-Dependencies":8.0,"check:Fuzzing":0.0,"check:Branch-Protection":0.0,"check:SAST":0.0},"findings":[],"evidence":[{"kind":"scorecard-check","description":"Scorecard Maintained: 10/10 (30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10)","ref":"Maintained","url":"https://scorecard.dev/viewer/?uri=github.com/CyC2018/CS-Notes","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Code-Review: 0/10 (Found 0/1 approved changesets -- score normalized to 0)","ref":"Code-Review","url":"https://scorecard.dev/viewer/?uri=github.com/CyC2018/CS-Notes","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Token-Permissions: 10/10 (GitHub workflow tokens follow principle of least privilege)","ref":"Token-Permissions","url":"https://scorecard.dev/viewer/?uri=github.com/CyC2018/CS-Notes","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Dangerous-Workflow: 10/10 (no dangerous workflow patterns detected)","ref":"Dangerous-Workflow","url":"https://scorecard.dev/viewer/?uri=github.com/CyC2018/CS-Notes","weight":0.0},{"kind":"scorecard-check","description":"Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)","ref":"CII-Best-Practices","url":"https://scorecard.dev/viewer/?uri=github.com/CyC2018/CS-Notes","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Binary-Artifacts: 10/10 (no binaries found in the repo)","ref":"Binary-Artifacts","url":"https://scorecard.dev/viewer/?uri=github.com/CyC2018/CS-Notes","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Security-Policy: 0/10 (security policy file not detected)","ref":"Security-Policy","url":"https://scorecard.dev/viewer/?uri=github.com/CyC2018/CS-Notes","weight":1.0},{"kind":"scorecard-check","description":"Scorecard License: 0/10 (license file not detected)","ref":"License","url":"https://scorecard.dev/viewer/?uri=github.com/CyC2018/CS-Notes","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Pinned-Dependencies: 8/10 (dependency not pinned by hash detected -- score normalized to 8)","ref":"Pinned-Dependencies","url":"https://scorecard.dev/viewer/?uri=github.com/CyC2018/CS-Notes","weight":0.2},{"kind":"scorecard-check","description":"Scorecard Fuzzing: 0/10 (project is not fuzzed)","ref":"Fuzzing","url":"https://scorecard.dev/viewer/?uri=github.com/CyC2018/CS-Notes","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Branch-Protection: 0/10 (branch protection not enabled on development/release branches)","ref":"Branch-Protection","url":"https://scorecard.dev/viewer/?uri=github.com/CyC2018/CS-Notes","weight":1.0},{"kind":"scorecard-check","description":"Scorecard SAST: 0/10 (SAST tool is not run on all commits -- score normalized to 0)","ref":"SAST","url":"https://scorecard.dev/viewer/?uri=github.com/CyC2018/CS-Notes","weight":1.0}],"data":{"date":"2026-11-09","commit":"09bc1f9ab415ce18d60172b76300924b608bb158","matches_head":false},"error":null},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":12.0,"checked":12.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":4397.0,"attributed_commits":44.0,"attributed_commit_share":0.010006822833750284,"effective_loc":42988.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":2.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 43 attributed commits, 0 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"OpenAI Codex: 1 attributed commits, 0 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (fb83a173e9)","ref":"f702b72924acc7e802cb7384ab7ea230ba343f85","url":"https://github.com/CyC2018/CS-Notes/commit/f702b72924acc7e802cb7384ab7ea230ba343f85","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"67ed9c34e6ff1897c98e51bc7f5ff587bd153e03","url":"https://github.com/CyC2018/CS-Notes/commit/67ed9c34e6ff1897c98e51bc7f5ff587bd153e03","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"c6f1a5b8f041e30292b147914ce44207d34ab438","url":"https://github.com/CyC2018/CS-Notes/commit/c6f1a5b8f041e30292b147914ce44207d34ab438","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ffef13f0450e6661dff39e42174df2c2beb0548a","url":"https://github.com/CyC2018/CS-Notes/commit/ffef13f0450e6661dff39e42174df2c2beb0548a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ef47be84b9c3daae500dc6c5bcd46d7c6cddfc2d","url":"https://github.com/CyC2018/CS-Notes/commit/ef47be84b9c3daae500dc6c5bcd46d7c6cddfc2d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"3986b77ef40596c9dc41d3f51bf4af84df442fb2","url":"https://github.com/CyC2018/CS-Notes/commit/3986b77ef40596c9dc41d3f51bf4af84df442fb2","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"97ed6381d708bab49c629f0985b5d37531f26fa1","url":"https://github.com/CyC2018/CS-Notes/commit/97ed6381d708bab49c629f0985b5d37531f26fa1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"359581e1a3796e6be73f9f079676e312a212dde2","url":"https://github.com/CyC2018/CS-Notes/commit/359581e1a3796e6be73f9f079676e312a212dde2","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"af66bd701ec53aa84c4831e557b1a61777f46e4e","url":"https://github.com/CyC2018/CS-Notes/commit/af66bd701ec53aa84c4831e557b1a61777f46e4e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1fa68a2c06d046fb71c54bf836b7758f9cfcdd78","url":"https://github.com/CyC2018/CS-Notes/commit/1fa68a2c06d046fb71c54bf836b7758f9cfcdd78","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"77f2319e35f4cec67f73f158918277e82a0bda7b","url":"https://github.com/CyC2018/CS-Notes/commit/77f2319e35f4cec67f73f158918277e82a0bda7b","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"4eb6dfbdfea60be74b5e16764738185ad2fdb37a","url":"https://github.com/CyC2018/CS-Notes/commit/4eb6dfbdfea60be74b5e16764738185ad2fdb37a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"cc0ab9b863b241250768d376afb0cfcb4b02ee64","url":"https://github.com/CyC2018/CS-Notes/commit/cc0ab9b863b241250768d376afb0cfcb4b02ee64","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"28ff86d413131f1f37d6114376a9caaafe77b155","url":"https://github.com/CyC2018/CS-Notes/commit/28ff86d413131f1f37d6114376a9caaafe77b155","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"effd5d958e3a659be1c6955e8563d2a28d0c8b98","url":"https://github.com/CyC2018/CS-Notes/commit/effd5d958e3a659be1c6955e8563d2a28d0c8b98","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f0203dccc271cd0dc1d87470a6385b201e814817","url":"https://github.com/CyC2018/CS-Notes/commit/f0203dccc271cd0dc1d87470a6385b201e814817","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"b611ed19c9d6026b5dbe7b8ac9d64c1b3c4587e3","url":"https://github.com/CyC2018/CS-Notes/commit/b611ed19c9d6026b5dbe7b8ac9d64c1b3c4587e3","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"617b68bad049642f1487ab3343a806ee0d069639","url":"https://github.com/CyC2018/CS-Notes/commit/617b68bad049642f1487ab3343a806ee0d069639","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"6391ea8c1bbae711b943e6090b6abfdea24859f8","url":"https://github.com/CyC2018/CS-Notes/commit/6391ea8c1bbae711b943e6090b6abfdea24859f8","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"aa76f4c922c3aba6d895d6e7eab46fd786dd4c4d","url":"https://github.com/CyC2018/CS-Notes/commit/aa76f4c922c3aba6d895d6e7eab46fd786dd4c4d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f32b8c0ea9dd35df166b344fcd12a478edf7fcf3","url":"https://github.com/CyC2018/CS-Notes/commit/f32b8c0ea9dd35df166b344fcd12a478edf7fcf3","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"2b56a2277f8f32ae5e4082a27edf8c5ac6c324df","url":"https://github.com/CyC2018/CS-Notes/commit/2b56a2277f8f32ae5e4082a27edf8c5ac6c324df","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"e959de03641c61ab98ec89bb91e0f79a33a52dd8","url":"https://github.com/CyC2018/CS-Notes/commit/e959de03641c61ab98ec89bb91e0f79a33a52dd8","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7108fceae6c4aa3d057548ecab838576efd2df09","url":"https://github.com/CyC2018/CS-Notes/commit/7108fceae6c4aa3d057548ecab838576efd2df09","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"bcaa95122d1a81163f64c94f3bf74b2fabc34554","url":"https://github.com/CyC2018/CS-Notes/commit/bcaa95122d1a81163f64c94f3bf74b2fabc34554","weight":0.9}],"data":{"attributed_loc_by_commit":{"766d3bafbe0f39bee2afa4781f3eecd49facaa6d":0,"551d546841c7137a7530f2f33f838dae739fc8e8":0,"9b93c24c0151ebd6ea0ac6da7263c0fd3a5d9069":0,"e478ecfae41fd48ff9f8e022398e18f445582b8a":0,"da3364c44803ecae63e09c3dbf212e13eedfed8e":0,"88b5227bb7f302eeaea6af2b39f1e7bdce0ba3b8":0,"85176682189c6ce7564b34deba00a919494fb2bc":0,"d580348a0feeec5cd0ad4bd71dc5c0a508045b0c":0,"8a60f69a450f665a0e9f7bab47787b94b8c38041":0,"f030caa9dbbd5b7d185b86e2f81f2f2889cbe186":0,"4490c13e95eb010d8b7e5a8fc080685376babe8c":0,"ff57167333ce0abc3c04ce3a79252b31364234c6":0,"05c448de3fec34fec88ea2431564de6d9eb92419":0,"8a44ea98e24169a3bf0a36c6ed310501f883624c":0,"25c3035321004009463ebb74a404839f399f52eb":0,"24514f45a0a8ffb15f0ee90b4b9d7483382c5369":0,"f7abf7950eacc966df7113b88fda6488326538f3":0,"150e2715f9aa28248b03406f5b1a983c78cbfc1c":0,"dc7cfef0bddecc9547887892cb441ba86197945d":0,"e959de03641c61ab98ec89bb91e0f79a33a52dd8":0,"7108fceae6c4aa3d057548ecab838576efd2df09":0,"bcaa95122d1a81163f64c94f3bf74b2fabc34554":0,"cc0ab9b863b241250768d376afb0cfcb4b02ee64":0,"28ff86d413131f1f37d6114376a9caaafe77b155":0,"effd5d958e3a659be1c6955e8563d2a28d0c8b98":0,"f0203dccc271cd0dc1d87470a6385b201e814817":0,"b611ed19c9d6026b5dbe7b8ac9d64c1b3c4587e3":0,"617b68bad049642f1487ab3343a806ee0d069639":0,"6391ea8c1bbae711b943e6090b6abfdea24859f8":0,"aa76f4c922c3aba6d895d6e7eab46fd786dd4c4d":0,"f32b8c0ea9dd35df166b344fcd12a478edf7fcf3":0,"2b56a2277f8f32ae5e4082a27edf8c5ac6c324df":0,"67ed9c34e6ff1897c98e51bc7f5ff587bd153e03":0,"c6f1a5b8f041e30292b147914ce44207d34ab438":0,"ffef13f0450e6661dff39e42174df2c2beb0548a":0,"ef47be84b9c3daae500dc6c5bcd46d7c6cddfc2d":0,"3986b77ef40596c9dc41d3f51bf4af84df442fb2":0,"97ed6381d708bab49c629f0985b5d37531f26fa1":0,"359581e1a3796e6be73f9f079676e312a212dde2":0,"af66bd701ec53aa84c4831e557b1a61777f46e4e":0,"1fa68a2c06d046fb71c54bf836b7758f9cfcdd78":0,"77f2319e35f4cec67f73f158918277e82a0bda7b":0,"4eb6dfbdfea60be74b5e16764738185ad2fdb37a":0,"f702b72924acc7e802cb7384ab7ea230ba343f85":0},"tools":{"claude-code":{"name":"Claude Code","commits":43,"loc":0,"first_seen":1792696988,"last_seen":1792701585},"openai-codex":{"name":"OpenAI Codex","commits":1,"loc":0,"first_seen":1793134716,"last_seen":1793134716}},"monthly":{"2018-02":{"loc":14926,"attributed_loc":0},"2018-03":{"loc":0,"attributed_loc":0},"2018-04":{"loc":0,"attributed_loc":0},"2018-05":{"loc":0,"attributed_loc":0},"2018-06":{"loc":0,"attributed_loc":0},"2018-07":{"loc":0,"attributed_loc":0},"2018-08":{"loc":0,"attributed_loc":0},"2018-09":{"loc":0,"attributed_loc":0},"2018-10":{"loc":0,"attributed_loc":0},"2018-11":{"loc":0,"attributed_loc":0},"2018-12":{"loc":23967,"attributed_loc":0},"2019-01":{"loc":0,"attributed_loc":0},"2019-02":{"loc":0,"attributed_loc":0},"2019-03":{"loc":0,"attributed_loc":0},"2019-04":{"loc":3,"attributed_loc":0},"2019-05":{"loc":0,"attributed_loc":0},"2019-06":{"loc":14,"attributed_loc":0},"2019-07":{"loc":0,"attributed_loc":0},"2019-08":{"loc":0,"attributed_loc":0},"2019-09":{"loc":0,"attributed_loc":0},"2019-10":{"loc":0,"attributed_loc":0},"2019-11":{"loc":0,"attributed_loc":0},"2019-12":{"loc":0,"attributed_loc":0},"2020-01":{"loc":0,"attributed_loc":0},"2020-02":{"loc":0,"attributed_loc":0},"2020-03":{"loc":0,"attributed_loc":0},"2020-04":{"loc":0,"attributed_loc":0},"2020-05":{"loc":0,"attributed_loc":0},"2020-07":{"loc":0,"attributed_loc":0},"2020-08":{"loc":0,"attributed_loc":0},"2020-09":{"loc":0,"attributed_loc":0},"2020-10":{"loc":0,"attributed_loc":0},"2020-11":{"loc":0,"attributed_loc":0},"2021-03":{"loc":0,"attributed_loc":0},"2021-04":{"loc":0,"attributed_loc":0},"2021-07":{"loc":0,"attributed_loc":0},"2022-02":{"loc":0,"attributed_loc":0},"2023-07":{"loc":0,"attributed_loc":0},"2026-10":{"loc":1938,"attributed_loc":0},"2026-11":{"loc":2140,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"work_units":28.0,"flagged_units":0.0,"pre_ai_era_bursts":3.0,"pre_ai_era_measured_loc":17390.0,"pre_ai_era_burst_loc":17373.0,"measured_loc":21468.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":2761.5,"median_loc_per_hour":286.3343431561553,"pr_timed_units":1.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":16362.0,"index":0.336,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":11.0,"per_kloc:emoji_in_code":0.672,"files:emoji_in_code":3.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":9.0,"secrets_low_confidence":0.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"website/deploy/deploy.test.mjs","line":137,"fingerprint":"website/deploy/deploy.test.mjs:generic-api-key:137"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"notes/HTTP.md","line":571,"fingerprint":"notes/HTTP.md:generic-api-key:571"},{"rule_id":"gitleaks/jwt","severity":"low","message":"Possible jwt secret in the current tree (test/docs/example file)","path":"notes/HTTP.md","line":500,"fingerprint":"notes/HTTP.md:jwt:500"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit b403735305); removed from the current tree but still retrievable","path":"README.md","line":106,"fingerprint":"b403735305cd570ff7d3cf3ff1dc7a3c6796b427:README.md:generic-api-key:106"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 348f6335eb); removed from the current tree but still retrievable","path":"相关内容.md","line":6,"fingerprint":"348f6335ebe2cf651871fbe09c1fcefcc7e3a043:相关内容.md:generic-api-key:6"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit cb02ca7cf4); removed from the current tree but still retrievable","path":"other/Group.md","line":4,"fingerprint":"cb02ca7cf451d32017d3fded2a9a0b1c473ed9e1:other/Group.md:generic-api-key:4"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 10ca0b75df); removed from the current tree but still retrievable","path":"docs/index.html","line":53,"fingerprint":"10ca0b75dfa7b07332611137def2800d35d90dad:docs/index.html:generic-api-key:53"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit e9e604e6a7); removed from the current tree but still retrievable","path":"docs/index.html.dump","line":53,"fingerprint":"e9e604e6a7a87b379452e99fea1e59148831d621:docs/index.html.dump:generic-api-key:53"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 8c7aa37313); removed from the current tree but still retrievable","path":"docs1/docs/index.html","line":33,"fingerprint":"8c7aa37313080068e40869d594a39a4e9deb4eae:docs1/docs/index.html:generic-api-key:33"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":69.0,"findings_high":29.0,"findings_medium":40.0,"findings_low":0.0,"weighted_findings":32.1,"scanned_lines":16362.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"docs/_style/prism-master/components/prism-core.js","line":237,"fingerprint":"javascript.browser.security.insecure-document-method:docs/_style/prism-master/components/prism-core.js:237"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `env.element.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"docs/_style/prism-master/components/prism-core.js","line":237,"fingerprint":"javascript.browser.security.insecure-innerhtml:docs/_style/prism-master/components/prism-core.js:237"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"docs/_style/prism-master/components/prism-core.js","line":255,"fingerprint":"javascript.browser.security.insecure-document-method:docs/_style/prism-master/components/prism-core.js:255"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `env.element.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"docs/_style/prism-master/components/prism-core.js","line":255,"fingerprint":"javascript.browser.security.insecure-innerhtml:docs/_style/prism-master/components/prism-core.js:255"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"docs/_style/prism-master/examples.js","line":150,"fingerprint":"javascript.browser.security.insecure-document-method:docs/_style/prism-master/examples.js:150"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `examples[id].innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"docs/_style/prism-master/examples.js","line":150,"fingerprint":"javascript.browser.security.insecure-innerhtml:docs/_style/prism-master/examples.js:150"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"docs/_style/prism-master/plugins/command-line/prism-command-line.js","line":123,"fingerprint":"javascript.browser.security.insecure-document-method:docs/_style/prism-master/plugins/command-line/prism-command-line.js:123"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `prompt.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"docs/_style/prism-master/plugins/command-line/prism-command-line.js","line":123,"fingerprint":"javascript.browser.security.insecure-innerhtml:docs/_style/prism-master/plugins/command-line/prism-command-line.js:123"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"docs/_style/prism-master/plugins/line-numbers/prism-line-numbers.js","line":109,"fingerprint":"javascript.browser.security.insecure-document-method:docs/_style/prism-master/plugins/line-numbers/prism-line-numbers.js:109"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `lineNumbersWrapper.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"docs/_style/prism-master/plugins/line-numbers/prism-line-numbers.js","line":109,"fingerprint":"javascript.browser.security.insecure-innerhtml:docs/_style/prism-master/plugins/line-numbers/prism-line-numbers.js:109"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"docs/_style/prism-master/plugins/normalize-whitespace/prism-normalize-whitespace.js","line":185,"fingerprint":"javascript.browser.security.insecure-document-method:docs/_style/prism-master/plugins/normalize-whitespace/prism-normalize-whitespace.js:185"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `env.element.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"docs/_style/prism-master/plugins/normalize-whitespace/prism-normalize-whitespace.js","line":185,"fingerprint":"javascript.browser.security.insecure-innerhtml:docs/_style/prism-master/plugins/normalize-whitespace/prism-normalize-whitespace.js:185"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"docs/_style/prism-master/plugins/previewers/prism-previewers.js","line":354,"fingerprint":"javascript.browser.security.insecure-document-method:docs/_style/prism-master/plugins/previewers/prism-previewers.js:354"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `this._elt.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"docs/_style/prism-master/plugins/previewers/prism-previewers.js","line":354,"fingerprint":"javascript.browser.security.insecure-innerhtml:docs/_style/prism-master/plugins/previewers/prism-previewers.js:354"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"website/builder/build.py","line":322,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:website/builder/build.py:322"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"website/builder/verify_updates.py","line":23,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:website/builder/verify_updates.py:23"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"website/refresh.py","line":39,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:website/refresh.py:39"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"website/refresh.py","line":61,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:website/refresh.py:61"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"website/refresh.py","line":62,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:website/refresh.py:62"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"website/templates/search.js","line":391,"fingerprint":"javascript.browser.security.insecure-document-method:website/templates/search.js:391"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `panel.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"website/templates/search.js","line":391,"fingerprint":"javascript.browser.security.insecure-innerhtml:website/templates/search.js:391"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"website/templates/site.js","line":440,"fingerprint":"javascript.browser.security.insecure-document-method:website/templates/site.js:440"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `panel.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"website/templates/site.js","line":440,"fingerprint":"javascript.browser.security.insecure-innerhtml:website/templates/site.js:440"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"website/templates/site.js","line":618,"fingerprint":"javascript.browser.security.insecure-document-method:website/templates/site.js:618"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `box.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"website/templates/site.js","line":618,"fingerprint":"javascript.browser.security.insecure-innerhtml:website/templates/site.js:618"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"website/templates/site.js","line":707,"fingerprint":"javascript.browser.security.insecure-document-method:website/templates/site.js:707"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `meta.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"website/templates/site.js","line":707,"fingerprint":"javascript.browser.security.insecure-innerhtml:website/templates/site.js:707"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"website/templates/site.js","line":758,"fingerprint":"javascript.browser.security.insecure-document-method:website/templates/site.js:758"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `a.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"website/templates/site.js","line":758,"fingerprint":"javascript.browser.security.insecure-innerhtml:website/templates/site.js:758"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-require","severity":"medium","message":"Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load and run arbitrary code, or access arbitrary files. [confidence low]","path":"docs/_style/prism-master/components/index.js","line":61,"fingerprint":"javascript.lang.security.audit.detect-non-literal-require:docs/_style/prism-master/components/index.js:61"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `grammar` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"docs/_style/prism-master/components/prism-core.js","line":303,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:docs/_style/prism-master/components/prism-core.js:303"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `Prism` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"docs/_style/prism-master/components/prism-http.js","line":67,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:docs/_style/prism-master/components/prism-http.js:67"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"docs/_style/prism-master/components/prism-lisp.js","line":6,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:docs/_style/prism-master/components/prism-lisp.js:6"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `pattern` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"docs/_style/prism-master/components/prism-lisp.js","line":10,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:docs/_style/prism-master/components/prism-lisp.js:10"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `lang` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"docs/_style/prism-master/components/prism-pure.js","line":68,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:docs/_style/prism-master/components/prism-pure.js:68"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment","severity":"medium","message":"Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-ex [confidence low]","path":"docs/_style/prism-master/download.js","line":139,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-assignment:docs/_style/prism-master/download.js:139"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"docs/_style/prism-master/download.js","line":212,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:docs/_style/prism-master/download.js:212"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"docs/_style/prism-master/download.js","line":221,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:docs/_style/prism-master/download.js:221"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"docs/_style/prism-master/download.js","line":399,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:docs/_style/prism-master/download.js:399"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"docs/_style/prism-master/download.js","line":417,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:docs/_style/prism-master/download.js:417"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `spaces` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low]","path":"docs/_style/prism-master/plugins/normalize-whitespace/prism-normalize-whitespace.js","line":63,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:docs/_style/prism-master/plugins/normalize-whitespace/prism-normalize-whitespace.js:63"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `input` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"docs/_style/prism-master/plugins/normalize-whitespace/prism-normalize-whitespace.js","line":83,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:docs/_style/prism-master/plugins/normalize-whitespace/prism-normalize-whitespace.js:83"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"docs/_style/prism-master/plugins/previewers/prism-previewers.js","line":217,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:docs/_style/prism-master/plugins/previewers/prism-previewers.js:217"},{"rule_id":"opengrep/javascript.browser.security.raw-html-concat","severity":"medium","message":"User controlled data in a HTML string may result in XSS [confidence medium]","path":"docs/_style/prism-master/plugins/previewers/prism-previewers.js","line":354,"fingerprint":"javascript.browser.security.raw-html-concat:docs/_style/prism-master/plugins/previewers/prism-previewers.js:354"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `type` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"docs/_style/prism-master/plugins/previewers/prism-previewers.js","line":508,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:docs/_style/prism-master/plugins/previewers/prism-previewers.js:508"},{"rule_id":"opengrep/python.lang.security.audit.regex_dos","severity":"medium","message":"Detected usage of re.compile with an inefficient regular expression. This can lead to regular expression denial of service, which can result in service down time. Instead, check all regexes or use safer alternatives such as pyre2. [confidence low]","path":"website/builder/build.py","line":38,"fingerprint":"python.lang.security.audit.regex_dos:website/builder/build.py:38"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"website/builder/static_notes.cjs","line":50,"fingerprint":"javascript.lang.security.html-in-template-string:website/builder/static_notes.cjs:50"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"website/builder/static_notes.cjs","line":57,"fingerprint":"javascript.lang.security.html-in-template-string:website/builder/static_notes.cjs:57"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"website/builder/static_notes.cjs","line":65,"fingerprint":"javascript.lang.security.html-in-template-string:website/builder/static_notes.cjs:65"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"website/builder/static_notes.cjs","line":125,"fingerprint":"javascript.lang.security.html-in-template-string:website/builder/static_notes.cjs:125"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"website/builder/static_notes.cjs","line":133,"fingerprint":"javascript.lang.security.html-in-template-string:website/builder/static_notes.cjs:133"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dist` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"website/builder/static_notes.cjs","line":159,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:website/builder/static_notes.cjs:159"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"website/builder/static_notes.cjs","line":159,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:website/builder/static_notes.cjs:159"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"website/builder/static_notes.cjs","line":168,"fingerprint":"javascript.lang.security.html-in-template-string:website/builder/static_notes.cjs:168"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"website/builder/static_notes.cjs","line":170,"fingerprint":"javascript.lang.security.html-in-template-string:website/builder/static_notes.cjs:170"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"website/builder/static_notes.cjs","line":170,"fingerprint":"javascript.lang.security.html-in-template-string:website/builder/static_notes.cjs:170"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dist` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"website/builder/static_notes.cjs","line":172,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:website/builder/static_notes.cjs:172"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"website/builder/static_notes.cjs","line":172,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:website/builder/static_notes.cjs:172"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"website/builder/static_notes.cjs","line":178,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:website/builder/static_notes.cjs:178"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dist` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"website/builder/static_notes.cjs","line":179,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:website/builder/static_notes.cjs:179"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dist` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"website/builder/static_notes.cjs","line":183,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:website/builder/static_notes.cjs:183"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"website/builder/static_notes.cjs","line":183,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:website/builder/static_notes.cjs:183"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"website/builder/static_notes.cjs","line":183,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:website/builder/static_notes.cjs:183"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `dist` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"website/builder/static_notes.cjs","line":184,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:website/builder/static_notes.cjs:184"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"website/builder/static_notes.cjs","line":184,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:website/builder/static_notes.cjs:184"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"website/builder/static_notes.cjs","line":184,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:website/builder/static_notes.cjs:184"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `term` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"website/templates/search.js","line":48,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:website/templates/search.js:48"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `word` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"website/templates/search.js","line":78,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:website/templates/search.js:78"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `query` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlle [confidence low]","path":"website/templates/search.js","line":352,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:website/templates/search.js:352"}],"evidence":[],"data":{"rulesets":["javascript","python"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":1.0,"vulnerabilities":1.0,"vulns_critical":0.0,"vulns_high":0.0,"vulns_medium":1.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":3.0},"findings":[{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@10.2.6 (npm) is affected by GHSA-g3hv-75wg-m249","path":"website/deploy/package-lock.json","line":null,"fingerprint":"minimatch@10.2.6 (npm):GHSA-g3hv-75wg-m249"}],"evidence":[],"data":{"ecosystems":["PyPI","npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":0.0,"findings_high":0.0,"findings_medium":0.0,"findings_low":0.0,"penalty":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.005,"unpinned_manifests":2.0},"findings":[],"evidence":[{"kind":"posture","description":"docs/_style/prism-master/composer.json has no lockfile alongside it (unpinned dependencies)","ref":"docs/_style/prism-master/composer.json","url":null,"weight":0.3},{"kind":"posture","description":"docs/_style/prism-master/package.json has no lockfile alongside it (unpinned dependencies)","ref":"docs/_style/prism-master/package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":795.0,"function_nloc":9763.0,"mean_ccn":3.56,"p90_ccn":8.0,"complex_functions":22.0,"long_functions":11.0,"many_param_functions":0.0,"risky_nloc_share":0.2667},"findings":[],"evidence":[{"kind":"complex-function","description":"build in website/builder/build.py: complexity 56, 149 lines","ref":"website/builder/build.py","url":"https://github.com/CyC2018/CS-Notes/blob/cb9f180fb26da7b7100fde250a5dd137455b3a02/website/builder/build.py#L257","weight":0.9333333333333333},{"kind":"complex-function","description":"check in website/builder/check.py: complexity 39, 58 lines","ref":"website/builder/check.py","url":"https://github.com/CyC2018/CS-Notes/blob/cb9f180fb26da7b7100fde250a5dd137455b3a02/website/builder/check.py#L14","weight":0.65},{"kind":"complex-function","description":"walkTokens in docs/_style/prism-master/components/prism-xquery.js: complexity 37, 56 lines","ref":"docs/_style/prism-master/components/prism-xquery.js","url":"https://github.com/CyC2018/CS-Notes/blob/cb9f180fb26da7b7100fde250a5dd137455b3a02/docs/_style/prism-master/components/prism-xquery.js#L81","weight":0.6166666666666667},{"kind":"complex-function","description":"matchGrammar in docs/_style/prism-master/components/prism-core.js: complexity 32, 93 lines","ref":"docs/_style/prism-master/components/prism-core.js","url":"https://github.com/CyC2018/CS-Notes/blob/cb9f180fb26da7b7100fde250a5dd137455b3a02/docs/_style/prism-master/components/prism-core.js#L277","weight":0.5333333333333333},{"kind":"complex-function","description":"walkTokens in docs/_style/prism-master/components/prism-jsx.js: complexity 29, 48 lines","ref":"docs/_style/prism-master/components/prism-jsx.js","url":"https://github.com/CyC2018/CS-Notes/blob/cb9f180fb26da7b7100fde250a5dd137455b3a02/docs/_style/prism-master/components/prism-jsx.js#L51","weight":0.48333333333333334},{"kind":"complex-function","description":"(anonymous) in docs/_style/prism-master/plugins/previewers/prism-previewers.js: complexity 29, 257 lines","ref":"docs/_style/prism-master/plugins/previewers/prism-previewers.js","url":"https://github.com/CyC2018/CS-Notes/blob/cb9f180fb26da7b7100fde250a5dd137455b3a02/docs/_style/prism-master/plugins/previewers/prism-previewers.js#L1","weight":0.48333333333333334},{"kind":"complex-function","description":"(anonymous) in docs/_style/prism-master/download.js: complexity 28, 163 lines","ref":"docs/_style/prism-master/download.js","url":"https://github.com/CyC2018/CS-Notes/blob/cb9f180fb26da7b7100fde250a5dd137455b3a02/docs/_style/prism-master/download.js#L5","weight":0.4666666666666667},{"kind":"complex-function","description":"(anonymous) in docs/_style/prism-master/plugins/wpd/prism-wpd.js: complexity 28, 59 lines","ref":"docs/_style/prism-master/plugins/wpd/prism-wpd.js","url":"https://github.com/CyC2018/CS-Notes/blob/cb9f180fb26da7b7100fde250a5dd137455b3a02/docs/_style/prism-master/plugins/wpd/prism-wpd.js#L55","weight":0.4666666666666667},{"kind":"complex-function","description":"search in website/templates/search.js: complexity 28, 47 lines","ref":"website/templates/search.js","url":"https://github.com/CyC2018/CS-Notes/blob/cb9f180fb26da7b7100fde250a5dd137455b3a02/website/templates/search.js#L226","weight":0.4666666666666667},{"kind":"complex-function","description":"readingProgress in website/templates/site.js: complexity 28, 55 lines","ref":"website/templates/site.js","url":"https://github.com/CyC2018/CS-Notes/blob/cb9f180fb26da7b7100fde250a5dd137455b3a02/website/templates/site.js#L831","weight":0.4666666666666667}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":11597.0,"duplicated_lines":321.0,"duplicated_share":0.0277,"files":198.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: docs/_style/prism-master/components/prism-asciidoc.js:226 and docs/_style/prism-master/components/prism-asciidoc.js:245","ref":"docs/_style/prism-master/components/prism-asciidoc.js","url":"https://github.com/CyC2018/CS-Notes/blob/cb9f180fb26da7b7100fde250a5dd137455b3a02/docs/_style/prism-master/components/prism-asciidoc.js#L226","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: docs/_style/prism-master/components/prism-csharp.js:17 and docs/_style/prism-master/components/prism-vala.js:7","ref":"docs/_style/prism-master/components/prism-csharp.js","url":"https://github.com/CyC2018/CS-Notes/blob/cb9f180fb26da7b7100fde250a5dd137455b3a02/docs/_style/prism-master/components/prism-csharp.js#L17","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: docs/_style/prism-master/components/prism-elixir.js:81 and docs/_style/prism-master/components/prism-haml.js:103","ref":"docs/_style/prism-master/components/prism-elixir.js","url":"https://github.com/CyC2018/CS-Notes/blob/cb9f180fb26da7b7100fde250a5dd137455b3a02/docs/_style/prism-master/components/prism-elixir.js#L81","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: docs/_style/prism-master/components/prism-erlang.js:31 and docs/_style/prism-master/components/prism-mel.js:31","ref":"docs/_style/prism-master/components/prism-erlang.js","url":"https://github.com/CyC2018/CS-Notes/blob/cb9f180fb26da7b7100fde250a5dd137455b3a02/docs/_style/prism-master/components/prism-erlang.js#L31","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: docs/_style/prism-master/components/prism-haml.js:133 and docs/_style/prism-master/components/prism-pug.js:177","ref":"docs/_style/prism-master/components/prism-haml.js","url":"https://github.com/CyC2018/CS-Notes/blob/cb9f180fb26da7b7100fde250a5dd137455b3a02/docs/_style/prism-master/components/prism-haml.js#L133","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: docs/_style/prism-master/components/prism-jsx.js:42 and docs/_style/prism-master/components/prism-xquery.js:72","ref":"docs/_style/prism-master/components/prism-jsx.js","url":"https://github.com/CyC2018/CS-Notes/blob/cb9f180fb26da7b7100fde250a5dd137455b3a02/docs/_style/prism-master/components/prism-jsx.js#L42","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: docs/_style/prism-master/components/prism-xeora.js:53 and docs/_style/prism-master/components/prism-xeora.js:67","ref":"docs/_style/prism-master/components/prism-xeora.js","url":"https://github.com/CyC2018/CS-Notes/blob/cb9f180fb26da7b7100fde250a5dd137455b3a02/docs/_style/prism-master/components/prism-xeora.js#L53","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: docs/_style/prism-master/plugins/autolinker/prism-autolinker.js:21 and docs/_style/prism-master/plugins/data-uri-highlight/prism-data-uri-highlight.js:46","ref":"docs/_style/prism-master/plugins/autolinker/prism-autolinker.js","url":"https://github.com/CyC2018/CS-Notes/blob/cb9f180fb26da7b7100fde250a5dd137455b3a02/docs/_style/prism-master/plugins/autolinker/prism-autolinker.js#L21","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: docs/_style/prism-master/plugins/previewers/prism-previewers.js:149 and docs/_style/prism-master/plugins/previewers/prism-previewers.js:279","ref":"docs/_style/prism-master/plugins/previewers/prism-previewers.js","url":"https://github.com/CyC2018/CS-Notes/blob/cb9f180fb26da7b7100fde250a5dd137455b3a02/docs/_style/prism-master/plugins/previewers/prism-previewers.js#L149","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":10.0,"weighted_findings":10.25,"scanned_lines":16362.0,"category:best-practice":1.0,"category:correctness":9.0},"findings":[{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'temporary.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'temporary.name' is used. Use '.flush()' or close the file before using 'temporary.name'.","path":"website/builder/site_assets.py","line":197,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:website/builder/site_assets.py:197"},{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'temporary.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'temporary.name' is used. Use '.flush()' or close the file before using 'temporary.name'.","path":"website/deploy/package_site.py","line":19,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:website/deploy/package_site.py:19"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"docs/_style/prism-master/components/index.js","line":61,"fingerprint":"javascript.lang.best-practice.lazy-load-module:docs/_style/prism-master/components/index.js:61"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"website/builder/test_search.cjs","line":175,"fingerprint":"javascript.lang.correctness.no-stringify-keys:website/builder/test_search.cjs:175"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"website/builder/test_search.cjs","line":176,"fingerprint":"javascript.lang.correctness.no-stringify-keys:website/builder/test_search.cjs:176"},{"rule_id":"opengrep/javascript.lang.correctness.eqeq-is-bad","severity":"low","message":"Detected a useless comparison operation `delNum == delNum` or `delNum != delNum`. This operation is always true. If testing for floating point NaN, use `math.isnan`, or `cmath.isnan` if the number is complex.","path":"docs/_style/prism-master/components/prism-core.js","line":395,"fingerprint":"javascript.lang.correctness.eqeq-is-bad:docs/_style/prism-master/components/prism-core.js:395"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`this.firstChild.style.backgroundImage` is assigned twice; the first assignment is useless","path":"docs/_style/prism-master/plugins/previewers/prism-previewers.js","line":138,"fingerprint":"javascript.lang.correctness.useless-assignment:docs/_style/prism-master/plugins/previewers/prism-previewers.js:138"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`this.style.backgroundColor` is assigned twice; the first assignment is useless","path":"docs/_style/prism-master/plugins/previewers/prism-previewers.js","line":271,"fingerprint":"javascript.lang.correctness.useless-assignment:docs/_style/prism-master/plugins/previewers/prism-previewers.js:271"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"website/builder/static_notes.cjs","line":88,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:website/builder/static_notes.cjs:88"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"website/builder/static_notes.cjs","line":88,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:website/builder/static_notes.cjs:88"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.1424,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":1165.0,"source_lines":16362.0,"test_ratio":0.0712,"ci_files":1.0,"cochange_share":0.0,"cochange_commits":50.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/website.yml","ref":".github/workflows/website.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":0.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":113.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":0.0,"other_lines":16362.0,"files_blamed":198.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:other_findings":10.0,"quality:other_per_kloc":0.611,"security:ai_findings":0.0,"security:other_findings":69.0,"security:other_per_kloc":4.217},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}