{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T15:26:57.589507Z","repo":{"ref":{"host":"github.com","owner":"Ebony-Vinyl","name":"dsh-our-free-model"},"default_branch":"main","clone_url":"https://github.com/Ebony-Vinyl/dsh-our-free-model.git","html_url":"https://github.com/Ebony-Vinyl/dsh-our-free-model","description":"在 dsh 里装上这个插件即可，无需登录、注册或填 API Key，就能使用包括 DeepSeek V4.1 Flash、Kimi K3 在内的前沿模型——完全免费，不限量。 All you do is install this plugin in dsh: no login, no sign-up, no API key — the frontier models are just there, DeepSeek V4.1 Flash and Kimi K3 among them. Completely free, with no usage cap.","stars":73982,"forks":2055,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":248376,"primary_language":"JavaScript","license_spdx":"MIT","created_at":"2026-09-24T16:17:19Z","pushed_at":"2026-11-13T07:47:23Z","security_policy_url":null,"distribution":{"owner_created_at":"2025-11-22T13:54:42Z","owner_type":"User","release_assets":[{"name":"dsh-our-free-model-2.8.3.tgz","size":30143785,"download_count":13050,"release_tag":"v2.8.3","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.3/dsh-our-free-model-2.8.3.tgz"},{"name":"Our.Free.Model_2.8.3_aarch64.dmg","size":46255323,"download_count":766,"release_tag":"v2.8.3","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.3/Our.Free.Model_2.8.3_aarch64.dmg"},{"name":"Our.Free.Model_2.8.3_x64-setup.exe","size":26230294,"download_count":7137,"release_tag":"v2.8.3","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.3/Our.Free.Model_2.8.3_x64-setup.exe"},{"name":"plugin-2.8.3.json","size":475,"download_count":2152,"release_tag":"v2.8.3","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.3/plugin-2.8.3.json"},{"name":"SHA256SUMS","size":379,"download_count":5056,"release_tag":"v2.8.3","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.3/SHA256SUMS"},{"name":"Our.Free.Model_2.8.2_aarch64.dmg","size":46255597,"download_count":65,"release_tag":"v2.8.2-macos-unofficial","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.2-macos-unofficial/Our.Free.Model_2.8.2_aarch64.dmg"},{"name":"dsh-our-free-model-2.8.2.tgz","size":28703336,"download_count":771,"release_tag":"v2.8.2","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.2/dsh-our-free-model-2.8.2.tgz"},{"name":"Our.Free.Model_2.8.2_aarch64.dmg","size":46255597,"download_count":38,"release_tag":"v2.8.2","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.2/Our.Free.Model_2.8.2_aarch64.dmg"},{"name":"Our.Free.Model_2.8.2_x64-setup.exe","size":26240600,"download_count":598,"release_tag":"v2.8.2","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.2/Our.Free.Model_2.8.2_x64-setup.exe"},{"name":"plugin-2.8.2.json","size":475,"download_count":121,"release_tag":"v2.8.2","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.2/plugin-2.8.2.json"},{"name":"SHA256SUMS","size":379,"download_count":314,"release_tag":"v2.8.2","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.2/SHA256SUMS"},{"name":"Our.Free.Model_2.7.1_aarch64.dmg","size":46110489,"download_count":1560,"release_tag":"v2.8.0-macos-unofficial","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.0-macos-unofficial/Our.Free.Model_2.7.1_aarch64.dmg"},{"name":"dsh-our-free-model-2.8.0.tgz","size":28563787,"download_count":12489,"release_tag":"v2.8.0","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.0/dsh-our-free-model-2.8.0.tgz"},{"name":"plugin-2.8.0.json","size":2417,"download_count":1744,"release_tag":"v2.8.0","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.0/plugin-2.8.0.json"},{"name":"SHA256SUMS","size":179,"download_count":3293,"release_tag":"v2.8.0","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.0/SHA256SUMS"},{"name":"Our.Free.Model_2.7.1_aarch64.dmg","size":46069399,"download_count":340,"release_tag":"v2.7.4-macos-unofficial","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.7.4-macos-unofficial/Our.Free.Model_2.7.1_aarch64.dmg"},{"name":"dsh-our-free-model-2.7.4.tgz","size":36452452,"download_count":2759,"release_tag":"v2.7.4","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.7.4/dsh-our-free-model-2.7.4.tgz"},{"name":"plugin-2.7.4.json","size":2431,"download_count":353,"release_tag":"v2.7.4","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.7.4/plugin-2.7.4.json"},{"name":"SHA256SUMS","size":179,"download_count":549,"release_tag":"v2.7.4","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.7.4/SHA256SUMS"},{"name":"Our.Free.Model_2.7.1_aarch64.dmg","size":46058865,"download_count":63,"release_tag":"v2.7.3-macos-unofficial","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.7.3-macos-unofficial/Our.Free.Model_2.7.1_aarch64.dmg"},{"name":"dsh-our-free-model-2.7.3.tgz","size":36440637,"download_count":4047,"release_tag":"v2.7.3","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.7.3/dsh-our-free-model-2.7.3.tgz"},{"name":"plugin-2.7.3.json","size":2395,"download_count":565,"release_tag":"v2.7.3","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.7.3/plugin-2.7.3.json"},{"name":"SHA256SUMS","size":179,"download_count":958,"release_tag":"v2.7.3","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.7.3/SHA256SUMS"},{"name":"dsh-our-free-model-2.7.2.tgz","size":36429808,"download_count":18888,"release_tag":"v2.7.2","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.7.2/dsh-our-free-model-2.7.2.tgz"},{"name":"plugin-2.7.2.json","size":1936,"download_count":2433,"release_tag":"v2.7.2","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.7.2/plugin-2.7.2.json"},{"name":"SHA256SUMS","size":181,"download_count":4936,"release_tag":"v2.7.2","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.7.2/SHA256SUMS"}]}},"commit_sha":"edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15","profile":{"lines_by_language":{"JavaScript":95451,"TypeScript":3340,"Rust":877,"Python":180},"files_by_category":{"source":353,"vendored":165,"docs":106,"binary":86,"config":44,"other":27,"oversized":9,"generated":4},"source_lines":99848,"test_lines":0},"pillars":{"ai_provenance":{"score":3.2,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.0323,"suspected_share":0.4851,"estimated_share":0.0323,"ai_artifacts":0.0,"flagged_work_units":13.0,"flagged_releases":5.0,"style_index":0.056},"summary":"Explicit AI attribution on 3% of first-party code added; an estimated 3% including velocity signals."},"quality":{"score":53.5,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":44.8,"duplication":67.6,"lint":59.9,"testing":35.0,"docs":65.0,"type_safety":96.9,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.00, CI runs tests; 27% of function code in complex or long functions; 7% duplicated lines. Weakest area: testing."},"security":{"score":48.7,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":19.5,"sast":93.5,"dependencies":61.7,"ci_actions":52.7,"posture":0.0,"scorecard":null},"summary":"Security posture is poor: 2 possible secret(s) in the tree, 2 only in history; 8 known vulnerabilities in 8 dependencies; 5 high-severity SAST findings; 4 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":30.0,"checked":30.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":677.0,"attributed_commits":42.0,"attributed_commit_share":0.0620384047267356,"effective_loc":233727.0,"attributed_loc":7548.0,"attributed_loc_share":0.032294086690882955,"tools_detected":2.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"OpenAI Codex: 41 attributed commits, 7,367 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Claude Code: 1 attributed commits, 181 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"28a7ce5ca929e039e504ee39c19c15942a04331f","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/28a7ce5ca929e039e504ee39c19c15942a04331f","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (f3ecb7abcf)","ref":"0a685e08f2759c002f20347e7a0b07a77bb70350","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/0a685e08f2759c002f20347e7a0b07a77bb70350","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (3bbc85e123)","ref":"ed87b87ed604aaeeeed95b4174d12077883363b4","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/ed87b87ed604aaeeeed95b4174d12077883363b4","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (08c6cd68e4)","ref":"81785dff5485e372924125dc9e879883a97b2c81","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/81785dff5485e372924125dc9e879883a97b2c81","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (08c6cd68e4)","ref":"e39631d39474e7e66c0121982a5b167233d7cf95","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/e39631d39474e7e66c0121982a5b167233d7cf95","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (08c6cd68e4)","ref":"405aba9d2d5d8dd67687904ea0511c7fcf518c8f","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/405aba9d2d5d8dd67687904ea0511c7fcf518c8f","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (08c6cd68e4)","ref":"f0e905320a423fda9c812ad6767d33a6ed90a426","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/f0e905320a423fda9c812ad6767d33a6ed90a426","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (08c6cd68e4)","ref":"985301c3e0604a43811b98139ccac2070d0cc1a2","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/985301c3e0604a43811b98139ccac2070d0cc1a2","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (08c6cd68e4)","ref":"dbe292f121745bd68ee5eab25fe26fa8987f2c4f","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/dbe292f121745bd68ee5eab25fe26fa8987f2c4f","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (08c6cd68e4)","ref":"86914d46257cc5fea62832ecb4f5d2aad8589894","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/86914d46257cc5fea62832ecb4f5d2aad8589894","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (08c6cd68e4)","ref":"ce5789caceeb34148bcc1c58280cab8b8869954e","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/ce5789caceeb34148bcc1c58280cab8b8869954e","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (08c6cd68e4)","ref":"f09733038c5012766bba96032d7b5f2109219a97","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/f09733038c5012766bba96032d7b5f2109219a97","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (25ab765d6b)","ref":"5866c24e29ea9d0af54502009ba7fc8463dbbf6d","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/5866c24e29ea9d0af54502009ba7fc8463dbbf6d","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (25ab765d6b)","ref":"9ce93072de50784ac4e23cd9c2e78c5c07bd9497","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/9ce93072de50784ac4e23cd9c2e78c5c07bd9497","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (1f92730b38)","ref":"af7e37ec2a44e831eeb400c0cc6e38c5b76848d4","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/af7e37ec2a44e831eeb400c0cc6e38c5b76848d4","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (1f92730b38)","ref":"8d655fd267d3069ba3aeb30748ed72c4f07d408e","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/8d655fd267d3069ba3aeb30748ed72c4f07d408e","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (1f92730b38)","ref":"fe8d760b635f28b1c4ec55e4b5324206910f5b44","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/fe8d760b635f28b1c4ec55e4b5324206910f5b44","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (1f92730b38)","ref":"aeeae90f76401410a356fe3587b0b907071470a3","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/aeeae90f76401410a356fe3587b0b907071470a3","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (1f92730b38)","ref":"c22d0ce86f4c454521fb1927008ce93a84c05c65","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/c22d0ce86f4c454521fb1927008ce93a84c05c65","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (1f92730b38)","ref":"6fba52df6d1d43374022da51de9cc8a0a14ca89f","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/6fba52df6d1d43374022da51de9cc8a0a14ca89f","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (1277977c18)","ref":"800e1ea9e1015936e213493047fa4fb148dbba9f","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/800e1ea9e1015936e213493047fa4fb148dbba9f","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (207f58c6be)","ref":"3ca8080cf8b04b1325c07d28dbd284f5fea5dafd","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/3ca8080cf8b04b1325c07d28dbd284f5fea5dafd","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (207f58c6be)","ref":"536bcd552f087ef635370cbc4f693fdb957b6063","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/536bcd552f087ef635370cbc4f693fdb957b6063","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (207f58c6be)","ref":"e2a733f3fef8a20cc8a10667d20b7916af76ef50","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/e2a733f3fef8a20cc8a10667d20b7916af76ef50","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: on merged branch (207f58c6be)","ref":"47eea49b4b75b49e2584aaa0b16f2ccb92e08536","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/47eea49b4b75b49e2584aaa0b16f2ccb92e08536","weight":0.9}],"data":{"attributed_loc_by_commit":{"e6d691a149ee842b8337541125ba9faf486c648d":120,"501df0eabfd410f461a7553a2d99e2c696d86513":20,"59712aad2d93399365a58d377187466542c7428d":0,"736dd6977e0c4dcec5848db331620b4d6811a666":14,"e791ed874815a00a94c0b221bcc555eaf8c9c855":0,"467f22b8760de15ca68aecb8b10c5344c87d6762":4,"c9c53515662f135b96a9e64d7f53c1aa19583933":0,"7c8d432c6e1189b68abf8ad2d2d0128a4be5c7cd":25,"6004c27ba4de004c3ec571dbbb86be120b576333":47,"d73ddba6ce4bd09bff6f22640fe0687cf7dd99be":9,"9ce865ed1de36da4ab95749aa1e4f8a6566b96d6":0,"807826000bddf62155b405fde913a1887001cd73":4,"601af4b42c6838676097d73912487255c9ce1e16":0,"914cfbf9355bccfba942048bba91c4b65afe4816":352,"6f4f99ca9027fafc94270984fbe34e2423d64571":0,"47eea49b4b75b49e2584aaa0b16f2ccb92e08536":0,"f7db1eefe9718bf1e9dba12b0769072964b56d8a":32,"58d87c7c3cf3c46a4de1eb6feb5b2422b537079a":50,"e2a733f3fef8a20cc8a10667d20b7916af76ef50":18,"536bcd552f087ef635370cbc4f693fdb957b6063":0,"3ca8080cf8b04b1325c07d28dbd284f5fea5dafd":0,"800e1ea9e1015936e213493047fa4fb148dbba9f":0,"6fba52df6d1d43374022da51de9cc8a0a14ca89f":111,"aeeae90f76401410a356fe3587b0b907071470a3":0,"c22d0ce86f4c454521fb1927008ce93a84c05c65":5398,"fe8d760b635f28b1c4ec55e4b5324206910f5b44":2,"8d655fd267d3069ba3aeb30748ed72c4f07d408e":0,"af7e37ec2a44e831eeb400c0cc6e38c5b76848d4":0,"9ce93072de50784ac4e23cd9c2e78c5c07bd9497":0,"5866c24e29ea9d0af54502009ba7fc8463dbbf6d":0,"ce5789caceeb34148bcc1c58280cab8b8869954e":960,"f09733038c5012766bba96032d7b5f2109219a97":118,"86914d46257cc5fea62832ecb4f5d2aad8589894":0,"985301c3e0604a43811b98139ccac2070d0cc1a2":0,"dbe292f121745bd68ee5eab25fe26fa8987f2c4f":0,"405aba9d2d5d8dd67687904ea0511c7fcf518c8f":6,"f0e905320a423fda9c812ad6767d33a6ed90a426":37,"e39631d39474e7e66c0121982a5b167233d7cf95":0,"81785dff5485e372924125dc9e879883a97b2c81":0,"ed87b87ed604aaeeeed95b4174d12077883363b4":40,"0a685e08f2759c002f20347e7a0b07a77bb70350":0,"28a7ce5ca929e039e504ee39c19c15942a04331f":181},"tools":{"openai-codex":{"name":"OpenAI Codex","commits":41,"loc":7367,"first_seen":1790789100,"last_seen":1792818023},"claude-code":{"name":"Claude Code","commits":1,"loc":181,"first_seen":1793333160,"last_seen":1793333160}},"monthly":{"2026-09":{"loc":14371,"attributed_loc":158},"2026-10":{"loc":192263,"attributed_loc":7390},"2026-11":{"loc":27093,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"work_units":196.0,"flagged_units":13.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":178658.0,"flagged_loc":118887.0,"flagged_loc_share":0.6654445924615746,"max_loc_per_hour":36956.90866510539,"median_loc_per_hour":131.25,"pr_timed_units":12.0,"excluded_import_loc":55069.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"70,136 lines of first-party code in ~1.9h (36,957 lines/hour, 11 commit session)","ref":"61d6f6180f3168d0aeb2023f3e42b2189d4525fe","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/61d6f6180f3168d0aeb2023f3e42b2189d4525fe","weight":0.6},{"kind":"velocity-burst","description":"7,324 lines of first-party code in ~4.1h (1,799 lines/hour, 3 commit session)","ref":"8ec94d882786628372d1ed131e7d09dfe750f0f7","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/8ec94d882786628372d1ed131e7d09dfe750f0f7","weight":0.5395947881847329},{"kind":"velocity-burst","description":"8,116 lines of first-party code in ~5.2h (1,561 lines/hour, 4 commit session)","ref":"d2396e619301323adcf78c97febb42b4cc302515","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/d2396e619301323adcf78c97febb42b4cc302515","weight":0.4683558642799893},{"kind":"velocity-burst","description":"1,531 lines of first-party code in ~1.1h (1,444 lines/hour, 1 commit session)","ref":"4fd6d2bc699630f113f82bfe3665cd308f55b83e","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/4fd6d2bc699630f113f82bfe3665cd308f55b83e","weight":0.43318836782813724},{"kind":"velocity-burst","description":"5,511 lines of first-party code in ~4.0h (1,369 lines/hour, 3 commit session)","ref":"fe8d760b635f28b1c4ec55e4b5324206910f5b44","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/fe8d760b635f28b1c4ec55e4b5324206910f5b44","weight":0.4107010764559757},{"kind":"velocity-burst","description":"5,223 lines of first-party code in ~5.2h (999 lines/hour, 3 commit session)","ref":"ffba390582bf06b990707123608a31a7dac98643","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/ffba390582bf06b990707123608a31a7dac98643","weight":0.2996302985233188},{"kind":"velocity-burst","description":"3,474 lines of first-party code in ~4.1h (844 lines/hour, 2 commit session)","ref":"999e9f784ea3ea7a11cae383b142697b1ff2c42f","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/999e9f784ea3ea7a11cae383b142697b1ff2c42f","weight":0.25331982985618795},{"kind":"velocity-burst","description":"3,335 lines of first-party code in ~4.0h (834 lines/hour, 1 commit session)","ref":"fba1eb2594371557885e82ef0303e37e0906b11b","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/fba1eb2594371557885e82ef0303e37e0906b11b","weight":0.250125},{"kind":"velocity-burst","description":"3,016 lines of first-party code in ~3.7h (821 lines/hour, 1 commit session)","ref":"99c0153d5a53604679846d084599761d811a6b58","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/99c0153d5a53604679846d084599761d811a6b58","weight":0.2462413063199274},{"kind":"velocity-burst","description":"3,172 lines of first-party code in ~4.0h (793 lines/hour, 1 commit session)","ref":"2ccdd9c015b89b9419fb4b67f199d820e6ca2219","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/2ccdd9c015b89b9419fb4b67f199d820e6ca2219","weight":0.2379},{"kind":"velocity-burst","description":"3,380 lines of first-party code in ~4.6h (739 lines/hour, 7 commit session)","ref":"abd2cae9cfdad8dfa6900f4f160c6c6844951e0f","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/abd2cae9cfdad8dfa6900f4f160c6c6844951e0f","weight":0.22174705382092091},{"kind":"velocity-burst","description":"2,427 lines of first-party code in ~4.0h (607 lines/hour, 1 commit session)","ref":"d187bf1978029ccb2ec444604893367168948188","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/d187bf1978029ccb2ec444604893367168948188","weight":0.182025},{"kind":"velocity-burst","description":"2,242 lines of first-party code in ~4.0h (560 lines/hour, 1 commit session)","ref":"ea7f42538e5c8f157d56a394dc0dbe7c54a2ca1c","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/commit/ea7f42538e5c8f157d56a394dc0dbe7c54a2ca1c","weight":0.16815}],"data":{"flagged_loc_by_commit":{"99c0153d5a53604679846d084599761d811a6b58":3016,"fba1eb2594371557885e82ef0303e37e0906b11b":3335,"2ccdd9c015b89b9419fb4b67f199d820e6ca2219":3172,"b0bd324ceb58014a60e50aa9f607fb4c2bf66b16":3462,"999e9f784ea3ea7a11cae383b142697b1ff2c42f":12,"684842f9e763eb16daa661e75fa81b8007665a4f":1551,"af93bb3815f13bdf583d8a39e35f25b0d22b0add":1822,"ffba390582bf06b990707123608a31a7dac98643":1850,"4fd6d2bc699630f113f82bfe3665cd308f55b83e":1531,"14f1d03f30c40f1bfaba4acb333f497ecc068bac":82,"da2ff487ce7c98d0589915eb7464f40b1c1d18b9":625,"2cc9093ab8b69b607767c32d9605b4d9b8b08d2a":68893,"dbfbfba667d1e722e750b37e3a2abfe2db87c01b":23,"9646cf6d6ecf0a980750f77cac822f909733857e":340,"6d00723e4b2ee89b596d5ceef50b2129fecf31e2":1,"c52004b1138ae8d00492d6659029d4559f83beef":1,"a130bb199f66d2d16db7dc1f907d07ce15c121f0":2,"06d1d1508098f1f4a5e993c0920645cc4224e4d4":56,"61d6f6180f3168d0aeb2023f3e42b2189d4525fe":89,"d4431f9825c365a91384be19b8457b4245bbbe22":24,"d187bf1978029ccb2ec444604893367168948188":2427,"6fba52df6d1d43374022da51de9cc8a0a14ca89f":111,"c22d0ce86f4c454521fb1927008ce93a84c05c65":5398,"fe8d760b635f28b1c4ec55e4b5324206910f5b44":2,"a4f55b330de2574fb6f9bbc4c56665dcc054468d":110,"00cfdd7812c41ec00f1597aa2b3b727a66a7e7b1":6,"ad00b5eb38a5ea5ed7a5128d3e4026c9d2776ea6":117,"e8e1f9d9a434ebba5eec4e12cb48522b2f5492a0":1325,"4abc92628858b88ffa85322f1a1db7691a5d9d06":1802,"ac5364b890adc90dbc8f1c3e9c372d0b4c8a37c4":2,"abd2cae9cfdad8dfa6900f4f160c6c6844951e0f":18,"ea7f42538e5c8f157d56a394dc0dbe7c54a2ca1c":2242,"27b274eaf3154e50c1c68913cc4433c959d81528":3572,"8b8c1f94b2cba008592f18a79ce2aa51e3984f45":3415,"45fee9c7fe79c90438741a2aa1813a8605f884a1":1083,"d2396e619301323adcf78c97febb42b4cc302515":46,"c86d47551d497c5a87b014e6840d1f678e4f79bc":41,"fd136c57820186cfca22b56204553eaf98283a0b":40,"8ec94d882786628372d1ed131e7d09dfe750f0f7":7243},"excluded_import_commits":["4c8ca27c07cb62978d8720166a080646d4996798","8a08c4d243b44da1bff229495ad95eabc787777d","8d39cfe73c554ab4360516416615ab808b2710ec","d8656844afcd0ec5d0fb7a354e30ab247befe7a4","dbb1b82c0cb390be4f9aad25299c25f2af629be3"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"releases":45.0,"flagged_releases":5.0,"max_loc_per_day":44296.6},"findings":[],"evidence":[{"kind":"release-burst","description":"v1.4.6 → v2.0.0: 6,986 lines in 1.74 days (4,018.3 lines/day)","ref":"v1.4.6...v2.0.0","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/compare/v1.4.6...v2.0.0","weight":0.4},{"kind":"release-burst","description":"v2.0.0 → v2.1.0: 81,587 lines in 4.06 days (20,105.2 lines/day)","ref":"v2.0.0...v2.1.0","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/compare/v2.0.0...v2.1.0","weight":0.4},{"kind":"release-burst","description":"v2.3.0 → v2.4.0: 5,187 lines in 1.48 days (3,498.5 lines/day)","ref":"v2.3.0...v2.4.0","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/compare/v2.3.0...v2.4.0","weight":0.4},{"kind":"release-burst","description":"v2.5.1 → v2.5.2: 8,200 lines in 0.19 days (44,296.6 lines/day)","ref":"v2.5.1...v2.5.2","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/compare/v2.5.1...v2.5.2","weight":0.4},{"kind":"release-burst","description":"v2.5.8-macos-unofficial → v2.5.9: 5,611 lines in 0.82 days (6,802.6 lines/day)","ref":"v2.5.8-macos-unofficial...v2.5.9","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/compare/v2.5.8-macos-unofficial...v2.5.9","weight":0.4}],"data":{"releases":[{"from":"v1.1.2","to":"v1.2.2","loc":2964,"days":1.18,"loc_per_day":2515.3,"flagged":false},{"from":"v1.2.2","to":"v1.3.0","loc":525,"days":0.67,"loc_per_day":786.4,"flagged":false},{"from":"v1.3.0","to":"v1.3.1","loc":1019,"days":0.64,"loc_per_day":1581.8,"flagged":false},{"from":"v1.3.1","to":"v1.3.2","loc":2820,"days":4.93,"loc_per_day":572.3,"flagged":false},{"from":"v1.3.2","to":"v1.4.2","loc":3882,"days":1.99,"loc_per_day":1953.2,"flagged":false},{"from":"v1.4.2","to":"v1.4.3","loc":64,"days":0.06,"loc_per_day":1062.2,"flagged":false},{"from":"v1.4.3","to":"v1.4.4","loc":95,"days":0.07,"loc_per_day":1411.0,"flagged":false},{"from":"v1.4.4","to":"v1.4.5","loc":3831,"days":0.8,"loc_per_day":4762.8,"flagged":false},{"from":"v1.4.5","to":"v1.4.6","loc":202,"days":0.24,"loc_per_day":833.3,"flagged":false},{"from":"v1.4.6","to":"v2.0.0","loc":6986,"days":1.74,"loc_per_day":4018.3,"flagged":true},{"from":"v2.0.0","to":"v2.1.0","loc":81587,"days":4.06,"loc_per_day":20105.2,"flagged":true},{"from":"v2.1.0","to":"v2.2.0","loc":1582,"days":3.14,"loc_per_day":503.1,"flagged":false},{"from":"v2.2.0","to":"v2.3.0","loc":2231,"days":0.88,"loc_per_day":2543.2,"flagged":false},{"from":"v2.3.0","to":"v2.4.0","loc":5187,"days":1.48,"loc_per_day":3498.5,"flagged":true},{"from":"v2.4.0","to":"v2.5.0","loc":1864,"days":0.66,"loc_per_day":2841.4,"flagged":false},{"from":"v2.5.0","to":"v2.5.1","loc":59,"days":0.08,"loc_per_day":717.6,"flagged":false},{"from":"v2.5.1","to":"v2.5.2","loc":8200,"days":0.19,"loc_per_day":44296.6,"flagged":true},{"from":"v2.5.2","to":"v2.5.3","loc":165,"days":0.39,"loc_per_day":428.0,"flagged":false},{"from":"v2.5.3","to":"v2.5.4","loc":1742,"days":1.11,"loc_per_day":1572.0,"flagged":false},{"from":"v2.5.4","to":"v2.5.4-macos-unofficial","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v2.5.4-macos-unofficial","to":"v2.5.5","loc":10,"days":0.17,"loc_per_day":57.6,"flagged":false},{"from":"v2.5.5","to":"v2.5.5-macos-unofficial","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v2.5.5-macos-unofficial","to":"v2.5.6","loc":56,"days":0.33,"loc_per_day":167.5,"flagged":false},{"from":"v2.5.6","to":"v2.5.6-macos-unofficial","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v2.5.6-macos-unofficial","to":"v2.5.7","loc":3708,"days":0.89,"loc_per_day":4168.1,"flagged":false},{"from":"v2.5.7","to":"v2.5.7-macos-unofficial","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v2.5.7-macos-unofficial","to":"v2.5.8","loc":3127,"days":0.69,"loc_per_day":4556.0,"flagged":false},{"from":"v2.5.8","to":"v2.5.8-macos-unofficial","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v2.5.8-macos-unofficial","to":"v2.5.9","loc":5611,"days":0.82,"loc_per_day":6802.6,"flagged":true},{"from":"v2.5.9","to":"v2.5.9-macos-unofficial","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v2.5.9-macos-unofficial","to":"v2.6.0-macos-unofficial","loc":3562,"days":3.12,"loc_per_day":1140.4,"flagged":false},{"from":"v2.6.0-macos-unofficial","to":"v2.6.0","loc":178,"days":0.04,"loc_per_day":4272.0,"flagged":false},{"from":"v2.6.0","to":"v2.7.0","loc":305,"days":0.06,"loc_per_day":5325.8,"flagged":false},{"from":"v2.7.0","to":"v2.7.1","loc":93,"days":0.06,"loc_per_day":1432.8,"flagged":false},{"from":"v2.7.1","to":"v2.7.2","loc":3557,"days":0.82,"loc_per_day":4329.4,"flagged":false},{"from":"v2.7.2","to":"v2.7.3","loc":5288,"days":4.09,"loc_per_day":1291.9,"flagged":false},{"from":"v2.7.3","to":"v2.7.3-macos-unofficial","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v2.7.3-macos-unofficial","to":"v2.7.4","loc":2818,"days":0.87,"loc_per_day":3221.5,"flagged":false},{"from":"v2.7.4","to":"v2.7.4-macos-unofficial","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v2.7.4-macos-unofficial","to":"v2.8.0","loc":3481,"days":1.01,"loc_per_day":3438.5,"flagged":false},{"from":"v2.8.0","to":"v2.8.0-macos-unofficial","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v2.8.0-macos-unofficial","to":"v2.8.2","loc":17541,"days":6.49,"loc_per_day":2704.7,"flagged":false},{"from":"v2.8.2","to":"v2.8.2-macos-unofficial","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v2.8.2-macos-unofficial","to":"v2.8.3-macos-unofficial","loc":76,"days":0.58,"loc_per_day":131.8,"flagged":false},{"from":"v2.8.3-macos-unofficial","to":"v2.8.3","loc":9,"days":0.04,"loc_per_day":216.0,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":90081.0,"index":0.056,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":10.0,"per_kloc:emoji_in_code":0.111,"files:emoji_in_code":5.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":2.0,"secrets_history":2.0,"secrets_nonprod":0.0,"secrets_low_confidence":14.0},"findings":[{"rule_id":"gitleaks/curl-auth-header","severity":"high","message":"Possible curl-auth-header secret in the current tree","path":"packages/standalone/frontend/connection.tsx","line":15,"fingerprint":"packages/standalone/frontend/connection.tsx:curl-auth-header:15"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"scripts/extensions-test.mjs","line":332,"fingerprint":"scripts/extensions-test.mjs:generic-api-key:332"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"scripts/subscription-ui-test.mjs","line":33,"fingerprint":"scripts/subscription-ui-test.mjs:generic-api-key:33"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"scripts/workbench-test.mjs","line":204,"fingerprint":"scripts/workbench-test.mjs:generic-api-key:204"},{"rule_id":"gitleaks/curl-auth-header","severity":"high","message":"Possible curl-auth-header secret in the current tree","path":"packages/standalone/web/app.js","line":10,"fingerprint":"packages/standalone/web/app.js:curl-auth-header:10"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"scripts/vault-test.mjs","line":364,"fingerprint":"scripts/vault-test.mjs:generic-api-key:364"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"src/subscriptions.js","line":34,"fingerprint":"src/subscriptions.js:generic-api-key:34"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"vendor/channel-pack/src/gemini-oauth.ts","line":33,"fingerprint":"vendor/channel-pack/src/gemini-oauth.ts:generic-api-key:33"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"vendor/channel-pack/src/loomy-product.ts","line":119,"fingerprint":"vendor/channel-pack/src/loomy-product.ts:generic-api-key:119"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"packages/standalone/channels/business.mjs","line":41054,"fingerprint":"packages/standalone/channels/business.mjs:generic-api-key:41054"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"vendor/channel-pack/pack.js","line":41065,"fingerprint":"vendor/channel-pack/pack.js:generic-api-key:41065"},{"rule_id":"gitleaks/private-key","severity":"medium","message":"Possible private-key secret in history (commit d8656844af); removed from the current tree but still retrievable","path":"scripts/codearts-direct-fetch-test.mjs","line":16,"fingerprint":"d8656844afcd0ec5d0fb7a354e30ab247befe7a4:scripts/codearts-direct-fetch-test.mjs:private-key:16"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit ea7f42538e); removed from the current tree but still retrievable","path":"client.js","line":53,"fingerprint":"ea7f42538e5c8f157d56a394dc0dbe7c54a2ca1c:client.js:generic-api-key:53"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit ea7f42538e); removed from the current tree but still retrievable","path":"src/sponsor.js","line":20,"fingerprint":"ea7f42538e5c8f157d56a394dc0dbe7c54a2ca1c:src/sponsor.js:generic-api-key:20"},{"rule_id":"gitleaks/curl-auth-header","severity":"medium","message":"Possible curl-auth-header secret in history (commit 0da7e86502); removed from the current tree but still retrievable","path":"packages/standalone/frontend/legacy.js","line":242,"fingerprint":"0da7e86502f0b191d51238381d18a3e59f377d96:packages/standalone/frontend/legacy.js:curl-auth-header:242"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit fba1eb2594); removed from the current tree but still retrievable","path":"vendor/jet-hub/src/loomy-product.ts","line":125,"fingerprint":"fba1eb2594371557885e82ef0303e37e0906b11b:vendor/jet-hub/src/loomy-product.ts:generic-api-key:125"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit fba1eb2594); removed from the current tree but still retrievable","path":"vendor/jet-hub/src/gemini-oauth.ts","line":38,"fingerprint":"fba1eb2594371557885e82ef0303e37e0906b11b:vendor/jet-hub/src/gemini-oauth.ts:generic-api-key:38"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit fba1eb2594); removed from the current tree but still retrievable","path":"vendor/jet-hub/pack.js","line":42551,"fingerprint":"fba1eb2594371557885e82ef0303e37e0906b11b:vendor/jet-hub/pack.js:generic-api-key:42551"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":68.0,"findings_high":5.0,"findings_medium":54.0,"findings_low":9.0,"weighted_findings":19.262,"scanned_lines":99848.0,"parse_errors":3.0},"findings":[{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/standalone/web/app.js","line":10,"fingerprint":"javascript.browser.security.insecure-document-method:packages/standalone/web/app.js:10"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `e.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/standalone/web/app.js","line":10,"fingerprint":"javascript.browser.security.insecure-innerhtml:packages/standalone/web/app.js:10"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/standalone/web/app.js","line":10,"fingerprint":"javascript.browser.security.insecure-document-method:packages/standalone/web/app.js:10"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `e.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/standalone/web/app.js","line":10,"fingerprint":"javascript.browser.security.insecure-innerhtml:packages/standalone/web/app.js:10"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/plugins-e2e.py","line":28,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/plugins-e2e.py:28"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"client.js","line":4081,"fingerprint":"javascript.lang.security.html-in-template-string:client.js:4081"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"index.js","line":1917,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:index.js:1917"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"packages/standalone/channels/runtime.mjs","line":37,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:packages/standalone/channels/runtime.mjs:37"},{"rule_id":"opengrep/javascript.browser.security.wildcard-postmessage-configuration","severity":"medium","message":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. [confidence medium]","path":"packages/standalone/frontend/plugin-page.tsx","line":57,"fingerprint":"javascript.browser.security.wildcard-postmessage-configuration:packages/standalone/frontend/plugin-page.tsx:57"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `format` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low]","path":"packages/standalone/library.mjs","line":266,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:packages/standalone/library.mjs:266"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `format` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controll [confidence low]","path":"packages/standalone/library.mjs","line":267,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:packages/standalone/library.mjs:267"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/standalone/management.mjs","line":207,"fingerprint":"javascript.lang.security.html-in-template-string:packages/standalone/management.mjs:207"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/standalone/management.mjs","line":209,"fingerprint":"javascript.lang.security.html-in-template-string:packages/standalone/management.mjs:209"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"packages/standalone/management.mjs","line":518,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:packages/standalone/management.mjs:518"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"packages/standalone/management.mjs","line":527,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:packages/standalone/management.mjs:527"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"packages/standalone/management.mjs","line":537,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:packages/standalone/management.mjs:537"},{"rule_id":"opengrep/javascript.jquery.security.audit.jquery-insecure-selector","severity":"medium","message":"User controlled data in a `$(...)` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/standalone/web/app.js","line":19,"fingerprint":"javascript.jquery.security.audit.jquery-insecure-selector:packages/standalone/web/app.js:19"},{"rule_id":"opengrep/javascript.browser.security.insufficient-postmessage-origin-validation","severity":"medium","message":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS). [confidence low]","path":"packages/standalone/web/app.js","line":19,"fingerprint":"javascript.browser.security.insufficient-postmessage-origin-validation:packages/standalone/web/app.js:19"},{"rule_id":"opengrep/javascript.browser.security.wildcard-postmessage-configuration","severity":"medium","message":"The target origin of the window.postMessage() API is set to \"*\". This could allow for information disclosure due to the possibility of any origin allowed to receive the message. [confidence medium]","path":"packages/standalone/web/app.js","line":19,"fingerprint":"javascript.browser.security.wildcard-postmessage-configuration:packages/standalone/web/app.js:19"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/channel-network-test.mjs","line":18,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/channel-network-test.mjs:18"},{"rule_id":"opengrep/javascript.lang.security.audit.unknown-value-with-script-tag","severity":"medium","message":"Cannot determine what 'plugin' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'plugin' is not externally controlled, or sanitize this data. [confidence low]","path":"scripts/engine-appearance-test.mjs","line":25,"fingerprint":"javascript.lang.security.audit.unknown-value-with-script-tag:scripts/engine-appearance-test.mjs:25"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/engine-appearance-test.mjs","line":42,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/engine-appearance-test.mjs:42"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"scripts/lib/fake-kernel.mjs","line":205,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:scripts/lib/fake-kernel.mjs:205"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/local-optimize-test.mjs","line":123,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/local-optimize-test.mjs:123"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/local-optimize-test.mjs","line":393,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/local-optimize-test.mjs:393"},{"rule_id":"opengrep/javascript.lang.security.audit.unknown-value-with-script-tag","severity":"medium","message":"Cannot determine what 'plugin' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'plugin' is not externally controlled, or sanitize this data. [confidence low]","path":"scripts/magpie-sandbox-test.mjs","line":23,"fingerprint":"javascript.lang.security.audit.unknown-value-with-script-tag:scripts/magpie-sandbox-test.mjs:23"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/magpie-sandbox-test.mjs","line":45,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/magpie-sandbox-test.mjs:45"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/probes/stream-terminal-frames.mjs","line":55,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/probes/stream-terminal-frames.mjs:55"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"scripts/rtk-shape-test.mjs","line":27,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:scripts/rtk-shape-test.mjs:27"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/sanitize-test.mjs","line":141,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/sanitize-test.mjs:141"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"scripts/subscription-ui-test.mjs","line":123,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:scripts/subscription-ui-test.mjs:123"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/test-all.mjs","line":24,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/test-all.mjs:24"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/updater-test.mjs","line":324,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/updater-test.mjs:324"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/updater-test.mjs","line":347,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/updater-test.mjs:347"},{"rule_id":"opengrep/javascript.lang.security.audit.hardcoded-hmac-key","severity":"medium","message":"Detected a hardcoded hmac key. Avoid hardcoding secrets and consider using an alternate option such as reading the secret from a config file or using an environment variable. [confidence low]","path":"scripts/vault-test.mjs","line":422,"fingerprint":"javascript.lang.security.audit.hardcoded-hmac-key:scripts/vault-test.mjs:422"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"src/adapter.js","line":222,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:src/adapter.js:222"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `raw` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled  [confidence low]","path":"src/eac.js","line":67,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/eac.js:67"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"src/eac.js","line":75,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/eac.js:75"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"src/http.js","line":500,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:src/http.js:500"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/local-optimize.js","line":287,"fingerprint":"javascript.lang.security.html-in-template-string:src/local-optimize.js:287"},{"rule_id":"opengrep/javascript.browser.security.insufficient-postmessage-origin-validation","severity":"medium","message":"No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS). [confidence low]","path":"src/magpie-engine.js","line":451,"fingerprint":"javascript.browser.security.insufficient-postmessage-origin-validation:src/magpie-engine.js:451"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/magpie-engine.js","line":603,"fingerprint":"javascript.lang.security.html-in-template-string:src/magpie-engine.js:603"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/magpie-engine.js","line":607,"fingerprint":"javascript.lang.security.html-in-template-string:src/magpie-engine.js:607"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/magpie-engine.js","line":609,"fingerprint":"javascript.lang.security.html-in-template-string:src/magpie-engine.js:609"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/magpie-engine.js","line":611,"fingerprint":"javascript.lang.security.html-in-template-string:src/magpie-engine.js:611"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"src/magpie-policy.js","line":187,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:src/magpie-policy.js:187"},{"rule_id":"opengrep/javascript.lang.security.insecure-object-assign","severity":"medium","message":"Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability. [confidence low]","path":"src/stream.js","line":601,"fingerprint":"javascript.lang.security.insecure-object-assign:src/stream.js:601"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `re` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled i [confidence low]","path":"src/token-saver.js","line":803,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/token-saver.js:803"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `re` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled i [confidence low]","path":"src/token-saver/rtk/autodetect.js","line":169,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/token-saver/rtk/autodetect.js:169"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"src/updater.js","line":899,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/updater.js:899"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"src/upstream.js","line":422,"fingerprint":"javascript.lang.security.html-in-template-string:src/upstream.js:422"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"worker/auth-github.mjs","line":141,"fingerprint":"javascript.lang.security.html-in-template-string:worker/auth-github.mjs:141"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"worker/auth-github.mjs","line":629,"fingerprint":"javascript.lang.security.html-in-template-string:worker/auth-github.mjs:629"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"worker/auth-github.mjs","line":636,"fingerprint":"javascript.lang.security.html-in-template-string:worker/auth-github.mjs:636"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"worker/auth-github.mjs","line":643,"fingerprint":"javascript.lang.security.html-in-template-string:worker/auth-github.mjs:643"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"worker/auth-github.mjs","line":646,"fingerprint":"javascript.lang.security.html-in-template-string:worker/auth-github.mjs:646"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"worker/auth-github.mjs","line":659,"fingerprint":"javascript.lang.security.html-in-template-string:worker/auth-github.mjs:659"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"worker/auth-github.mjs","line":663,"fingerprint":"javascript.lang.security.html-in-template-string:worker/auth-github.mjs:663"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"worker/auth-github.mjs","line":670,"fingerprint":"javascript.lang.security.html-in-template-string:worker/auth-github.mjs:670"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"packages/desktop/src-tauri/src/external.rs","line":16,"fingerprint":"rust.lang.security.unsafe-usage:packages/desktop/src-tauri/src/external.rs:16"},{"rule_id":"opengrep/rust.lang.security.temp-dir","severity":"low","message":"temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file.  [confidence high]","path":"packages/desktop/src-tauri/src/service.rs","line":209,"fingerprint":"rust.lang.security.temp-dir:packages/desktop/src-tauri/src/service.rs:209"},{"rule_id":"opengrep/rust.lang.security.current-exe","severity":"low","message":"current_exe should not be used for security operations. From the docs: \"The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change the output arbitrarily.\" [confidence high]","path":"packages/desktop/src-tauri/src/update.rs","line":150,"fingerprint":"rust.lang.security.current-exe:packages/desktop/src-tauri/src/update.rs:150"},{"rule_id":"opengrep/rust.lang.security.temp-dir","severity":"low","message":"temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file.  [confidence high]","path":"packages/desktop/src-tauri/src/update.rs","line":212,"fingerprint":"rust.lang.security.temp-dir:packages/desktop/src-tauri/src/update.rs:212"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"scripts/egress-test.mjs","line":551,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:scripts/egress-test.mjs:551"},{"rule_id":"opengrep/javascript.audit.detect-replaceall-sanitization","severity":"low","message":"Detected a call to `replaceAll()` in an attempt to HTML escape the string `String(text ?? '')`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as `sanitize-html` or `DOMPurify`. [confidence low]","path":"worker/auth-github.mjs","line":132,"fingerprint":"javascript.audit.detect-replaceall-sanitization:worker/auth-github.mjs:132"},{"rule_id":"opengrep/javascript.audit.detect-replaceall-sanitization","severity":"low","message":"Detected a call to `replaceAll()` in an attempt to HTML escape the string `String(text ?? '')\n    .replaceAll('&', '&amp;')`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as `sanitize-htm [confidence low]","path":"worker/auth-github.mjs","line":132,"fingerprint":"javascript.audit.detect-replaceall-sanitization:worker/auth-github.mjs:132"},{"rule_id":"opengrep/javascript.audit.detect-replaceall-sanitization","severity":"low","message":"Detected a call to `replaceAll()` in an attempt to HTML escape the string `String(text ?? '')\n    .replaceAll('&', '&amp;')\n    .replaceAll('<', '&lt;')`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization  [confidence low]","path":"worker/auth-github.mjs","line":132,"fingerprint":"javascript.audit.detect-replaceall-sanitization:worker/auth-github.mjs:132"},{"rule_id":"opengrep/javascript.audit.detect-replaceall-sanitization","severity":"low","message":"Detected a call to `replaceAll()` in an attempt to HTML escape the string `String(text ?? '')\n    .replaceAll('&', '&amp;')\n    .replaceAll('<', '&lt;')\n    .replaceAll('>', '&gt;')`. Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to u [confidence low]","path":"worker/auth-github.mjs","line":132,"fingerprint":"javascript.audit.detect-replaceall-sanitization:worker/auth-github.mjs:132"}],"evidence":[],"data":{"rulesets":["javascript","typescript","rust","python"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":8.0,"vulnerabilities":8.0,"vulns_critical":0.0,"vulns_high":1.0,"vulns_medium":1.0,"vulns_low":0.0,"vulns_unknown":6.0,"penalty":29.0},"findings":[{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.6.5 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"package-lock.json","line":null,"fingerprint":"zod@4.6.5 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-wrw7-89jp-8q8g","severity":"medium","message":"glib@0.18.5 (crates.io) is affected by RUSTSEC-2024-0429, GHSA-wrw7-89jp-8q8g","path":"packages/desktop/src-tauri/Cargo.lock","line":null,"fingerprint":"glib@0.18.5 (crates.io):GHSA-wrw7-89jp-8q8g"},{"rule_id":"osv/RUSTSEC-2024-0370","severity":"medium","message":"proc-macro-error@1.0.4 (crates.io) is affected by RUSTSEC-2024-0370","path":"packages/desktop/src-tauri/Cargo.lock","line":null,"fingerprint":"proc-macro-error@1.0.4 (crates.io):RUSTSEC-2024-0370"},{"rule_id":"osv/RUSTSEC-2026-0486","severity":"medium","message":"rustix@1.1.5 (crates.io) is affected by RUSTSEC-2026-0486","path":"packages/desktop/src-tauri/Cargo.lock","line":null,"fingerprint":"rustix@1.1.5 (crates.io):RUSTSEC-2026-0486"},{"rule_id":"osv/RUSTSEC-2026-0386","severity":"medium","message":"tokio@1.53.2 (crates.io) is affected by RUSTSEC-2026-0386","path":"packages/desktop/src-tauri/Cargo.lock","line":null,"fingerprint":"tokio@1.53.2 (crates.io):RUSTSEC-2026-0386"},{"rule_id":"osv/RUSTSEC-2026-0371","severity":"medium","message":"zbus_names@4.3.4 (crates.io) is affected by RUSTSEC-2026-0371","path":"packages/desktop/src-tauri/Cargo.lock","line":null,"fingerprint":"zbus_names@4.3.4 (crates.io):RUSTSEC-2026-0371"},{"rule_id":"osv/RUSTSEC-2026-0370","severity":"medium","message":"zvariant@5.15.0 (crates.io) is affected by RUSTSEC-2026-0370","path":"packages/desktop/src-tauri/Cargo.lock","line":null,"fingerprint":"zvariant@5.15.0 (crates.io):RUSTSEC-2026-0370"},{"rule_id":"osv/RUSTSEC-2026-0372","severity":"medium","message":"zvariant_derive@5.15.0 (crates.io) is affected by RUSTSEC-2026-0372","path":"packages/desktop/src-tauri/Cargo.lock","line":null,"fingerprint":"zvariant_derive@5.15.0 (crates.io):RUSTSEC-2026-0372"}],"evidence":[],"data":{"ecosystems":["crates.io","npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":5.0,"findings":10.0,"findings_high":4.0,"findings_medium":6.0,"findings_low":0.0,"penalty":38.4},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-macos.yml","line":22,"fingerprint":"unpinned-uses:.github/workflows/build-macos.yml:22"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/build-macos.yml","line":19,"fingerprint":"cache-poisoning:.github/workflows/build-macos.yml:19"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/build-windows.yml","line":34,"fingerprint":"unpinned-uses:.github/workflows/build-windows.yml:34"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/build-windows.yml","line":31,"fingerprint":"cache-poisoning:.github/workflows/build-windows.yml:31"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/build-macos.yml","line":18,"fingerprint":"artipacked:.github/workflows/build-macos.yml:18"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/build-windows.yml","line":30,"fingerprint":"artipacked:.github/workflows/build-windows.yml:30"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":21,"fingerprint":"artipacked:.github/workflows/test.yml:21"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":38,"fingerprint":"artipacked:.github/workflows/test.yml:38"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":51,"fingerprint":"artipacked:.github/workflows/test.yml:51"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":61,"fingerprint":"artipacked:.github/workflows/test.yml:61"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.07,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":2.0,"binary_assets":14.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v2.8.3 ships dsh-our-free-model-2.8.3.tgz (13050 downloads)","ref":"dsh-our-free-model-2.8.3.tgz","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.3/dsh-our-free-model-2.8.3.tgz","weight":0.0},{"kind":"binary-release-asset","description":"release v2.8.3 ships Our.Free.Model_2.8.3_aarch64.dmg (766 downloads)","ref":"Our.Free.Model_2.8.3_aarch64.dmg","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.3/Our.Free.Model_2.8.3_aarch64.dmg","weight":0.0},{"kind":"binary-release-asset","description":"release v2.8.3 ships Our.Free.Model_2.8.3_x64-setup.exe (7137 downloads)","ref":"Our.Free.Model_2.8.3_x64-setup.exe","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.3/Our.Free.Model_2.8.3_x64-setup.exe","weight":0.0},{"kind":"binary-release-asset","description":"release v2.8.2-macos-unofficial ships Our.Free.Model_2.8.2_aarch64.dmg (65 downloads)","ref":"Our.Free.Model_2.8.2_aarch64.dmg","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.2-macos-unofficial/Our.Free.Model_2.8.2_aarch64.dmg","weight":0.0},{"kind":"binary-release-asset","description":"release v2.8.2 ships dsh-our-free-model-2.8.2.tgz (771 downloads)","ref":"dsh-our-free-model-2.8.2.tgz","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/releases/download/v2.8.2/dsh-our-free-model-2.8.2.tgz","weight":0.0},{"kind":"star-burst","description":"73982 stars in 51 days (1452/day)","ref":null,"url":null,"weight":0.0}],"data":{"signals":["binary-release-assets","star-burst"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":13817.0,"function_nloc":72991.0,"mean_ccn":2.96,"p90_ccn":6.0,"complex_functions":377.0,"long_functions":37.0,"many_param_functions":8.0,"risky_nloc_share":0.2676},"findings":[],"evidence":[{"kind":"complex-function","description":"handler in index.js: complexity 288, 466 lines","ref":"index.js","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/index.js#L1834","weight":1.0},{"kind":"complex-function","description":"route in packages/standalone/management.mjs: complexity 249, 375 lines","ref":"packages/standalone/management.mjs","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/packages/standalone/management.mjs#L255","weight":1.0},{"kind":"complex-function","description":"(anonymous) in packages/standalone/web/app.js: complexity 161, 1 lines","ref":"packages/standalone/web/app.js","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/packages/standalone/web/app.js#L9","weight":1.0},{"kind":"complex-function","description":"wv in packages/standalone/web/app.js: complexity 157, 1 lines","ref":"packages/standalone/web/app.js","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/packages/standalone/web/app.js#L9","weight":1.0},{"kind":"complex-function","description":"Ke in packages/standalone/web/app.js: complexity 145, 1 lines","ref":"packages/standalone/web/app.js","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/packages/standalone/web/app.js#L10","weight":1.0},{"kind":"complex-function","description":"Tf in packages/standalone/web/app.js: complexity 143, 1 lines","ref":"packages/standalone/web/app.js","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/packages/standalone/web/app.js#L9","weight":1.0},{"kind":"complex-function","description":"runSingle in src/adapter.js: complexity 143, 262 lines","ref":"src/adapter.js","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/src/adapter.js#L345","weight":1.0},{"kind":"complex-function","description":"Yv in packages/standalone/web/app.js: complexity 127, 1 lines","ref":"packages/standalone/web/app.js","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/packages/standalone/web/app.js#L10","weight":1.0},{"kind":"complex-function","description":"fromGeminiRequest in src/gemini.js: complexity 93, 124 lines","ref":"src/gemini.js","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/src/gemini.js#L103","weight":1.0},{"kind":"complex-function","description":"ot in packages/standalone/web/app.js: complexity 91, 1 lines","ref":"packages/standalone/web/app.js","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/packages/standalone/web/app.js#L10","weight":1.0}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":81100.0,"duplicated_lines":5292.0,"duplicated_share":0.0653,"files":353.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: client.js:1801 and packages/standalone/web/channels-CqFHCMz8.js:2","ref":"client.js","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/client.js#L1801","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: client.js:2398 and client.js:2580","ref":"client.js","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/client.js#L2398","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/standalone/frontend/agents.tsx:38 and packages/standalone/frontend/library.tsx:138","ref":"packages/standalone/frontend/agents.tsx","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/packages/standalone/frontend/agents.tsx#L38","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/standalone/frontend/library.tsx:62 and packages/standalone/frontend/library.tsx:102","ref":"packages/standalone/frontend/library.tsx","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/packages/standalone/frontend/library.tsx#L62","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/standalone/frontend/library.tsx:137 and packages/standalone/frontend/routing.tsx:195","ref":"packages/standalone/frontend/library.tsx","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/packages/standalone/frontend/library.tsx#L137","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/aggregate-test.mjs:434 and scripts/aggregate-test.mjs:475","ref":"scripts/aggregate-test.mjs","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/scripts/aggregate-test.mjs#L434","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/aggregate-wiring-test.mjs:34 and scripts/live-feature-verify.mjs:47","ref":"scripts/aggregate-wiring-test.mjs","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/scripts/aggregate-wiring-test.mjs#L34","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/aggregate-wiring-test.mjs:54 and scripts/ui-preview.mjs:60","ref":"scripts/aggregate-wiring-test.mjs","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/scripts/aggregate-wiring-test.mjs#L54","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/auto-checkin-tick-test.mjs:26 and scripts/opencode-parity-test.mjs:37","ref":"scripts/auto-checkin-tick-test.mjs","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/scripts/auto-checkin-tick-test.mjs#L26","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/channel-credits-ui-test.mjs:17 and scripts/channel-login-test.mjs:23","ref":"scripts/channel-credits-ui-test.mjs","url":"https://github.com/Ebony-Vinyl/dsh-our-free-model/blob/edfdaf2cb64bb39c7c682b90c96ef9e3fef3be15/scripts/channel-credits-ui-test.mjs#L17","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":536.0,"weighted_findings":205.0,"scanned_lines":99848.0,"category:best-practice":14.0,"category:correctness":521.0,"category:maintainability":1.0},"findings":[{"rule_id":"opengrep/typescript.lang.correctness.useless-ternary","severity":"high","message":"It looks like no matter how ctx.__captured is evaluated, this expression returns undefined. This is probably a copy-paste error.","path":"scripts/aggregate-wiring-test.mjs","line":199,"fingerprint":"typescript.lang.correctness.useless-ternary:scripts/aggregate-wiring-test.mjs:199"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"client.js","line":26,"fingerprint":"javascript.lang.best-practice.lazy-load-module:client.js:26"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"client.js","line":27,"fingerprint":"javascript.lang.best-practice.lazy-load-module:client.js:27"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"client.js","line":4574,"fingerprint":"typescript.react.best-practice.react-props-in-state:client.js:4574"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"client.js","line":7359,"fingerprint":"typescript.react.best-practice.react-props-in-state:client.js:7359"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/standalone/client-terminal.mjs","line":12,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/standalone/client-terminal.mjs:12"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/standalone/client-terminal.mjs","line":13,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/standalone/client-terminal.mjs:13"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/standalone/frontend/app.tsx","line":85,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/standalone/frontend/app.tsx:85"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/standalone/frontend/components/ui.tsx","line":16,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/standalone/frontend/components/ui.tsx:16"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/standalone/frontend/components/ui.tsx","line":23,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/standalone/frontend/components/ui.tsx:23"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/standalone/frontend/components/ui.tsx","line":28,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/standalone/frontend/components/ui.tsx:28"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/standalone/frontend/components/ui.tsx","line":35,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/standalone/frontend/components/ui.tsx:35"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/standalone/frontend/components/ui.tsx","line":40,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/standalone/frontend/components/ui.tsx:40"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/standalone/frontend/components/ui.tsx","line":46,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/standalone/frontend/components/ui.tsx:46"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/standalone/frontend/components/ui.tsx","line":50,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/standalone/frontend/components/ui.tsx:50"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/standalone/frontend/components/ui.tsx","line":58,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/standalone/frontend/components/ui.tsx:58"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/standalone/library.mjs","line":266,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/standalone/library.mjs:266"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/standalone/library.mjs","line":267,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/standalone/library.mjs:267"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/standalone/login-terminal.mjs","line":7,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/standalone/login-terminal.mjs:7"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/standalone/login-terminal.mjs","line":8,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/standalone/login-terminal.mjs:8"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"packages/standalone/open-external.mjs","line":12,"fingerprint":"javascript.lang.correctness.no-replaceall:packages/standalone/open-external.mjs:12"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"packages/standalone/workbench.mjs","line":151,"fingerprint":"javascript.lang.correctness.no-stringify-keys:packages/standalone/workbench.mjs:151"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/aggregate-test.mjs","line":508,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/aggregate-test.mjs:508"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/build-magpie-engine.mjs","line":155,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/build-magpie-engine.mjs:155"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/build-magpie-engine.mjs","line":157,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/build-magpie-engine.mjs:157"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/channel-pack-test.mjs","line":814,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/channel-pack-test.mjs:814"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/channel-pack-test.mjs","line":815,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/channel-pack-test.mjs:815"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/channel-pack-test.mjs","line":816,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/channel-pack-test.mjs:816"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/channel-pack-test.mjs","line":817,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/channel-pack-test.mjs:817"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/client-terminal-test.mjs","line":20,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/client-terminal-test.mjs:20"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/desktop-test.mjs","line":99,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/desktop-test.mjs:99"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/desktop-update-test.mjs","line":115,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/desktop-update-test.mjs:115"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/egress-test.mjs","line":408,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/egress-test.mjs:408"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/egress-test.mjs","line":410,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/egress-test.mjs:410"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/egress-test.mjs","line":411,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/egress-test.mjs:411"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/engine-transport-test.mjs","line":47,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/engine-transport-test.mjs:47"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/fingerprint-test.mjs","line":41,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/fingerprint-test.mjs:41"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/fingerprint-test.mjs","line":289,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/fingerprint-test.mjs:289"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/host-selftest.mjs","line":301,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/host-selftest.mjs:301"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/magpie-native-ui-test.mjs","line":149,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/magpie-native-ui-test.mjs:149"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"scripts/magpie-native-ui-test.mjs","line":269,"fingerprint":"javascript.lang.best-practice.lazy-load-module:scripts/magpie-native-ui-test.mjs:269"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/magpie-plugin-test.mjs","line":313,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/magpie-plugin-test.mjs:313"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/magpie-plugin-test.mjs","line":316,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/magpie-plugin-test.mjs:316"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/mint-eac-seal.mjs","line":58,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/mint-eac-seal.mjs:58"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/offline-test.mjs","line":132,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/offline-test.mjs:132"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/open-external-test.mjs","line":27,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/open-external-test.mjs:27"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/opencode-parity-test.mjs","line":153,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/opencode-parity-test.mjs:153"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/opencode-parity-test.mjs","line":159,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/opencode-parity-test.mjs:159"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"scripts/plugins-e2e.py","line":131,"fingerprint":"python.lang.maintainability.return-not-in-function:scripts/plugins-e2e.py:131"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/plugins-test.mjs","line":432,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/plugins-test.mjs:432"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/probes/stream-terminal-frames.mjs","line":57,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/probes/stream-terminal-frames.mjs:57"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/probes/stream-terminal-frames.mjs","line":58,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/probes/stream-terminal-frames.mjs:58"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/probes/tool-calling.mjs","line":42,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/probes/tool-calling.mjs:42"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/probes/tool-calling.mjs","line":42,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/probes/tool-calling.mjs:42"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/probes/tool-calling.mjs","line":43,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/probes/tool-calling.mjs:43"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/probes/tool-calling.mjs","line":44,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/probes/tool-calling.mjs:44"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/recovery-test.mjs","line":848,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/recovery-test.mjs:848"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/recovery-test.mjs","line":849,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/recovery-test.mjs:849"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/recovery-test.mjs","line":854,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/recovery-test.mjs:854"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/standalone-desktop-regression-test.mjs","line":17,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/standalone-desktop-regression-test.mjs:17"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/standalone-login-terminal-test.mjs","line":11,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/standalone-login-terminal-test.mjs:11"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/standalone-login-terminal-test.mjs","line":28,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/standalone-login-terminal-test.mjs:28"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/standalone-login-terminal-test.mjs","line":85,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/standalone-login-terminal-test.mjs:85"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/standalone-package-test.mjs","line":269,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/standalone-package-test.mjs:269"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/standalone-ui-preview.mjs","line":123,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/standalone-ui-preview.mjs:123"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/standalone-ui-preview.mjs","line":131,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/standalone-ui-preview.mjs:131"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/subscription-ui-test.mjs","line":46,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/subscription-ui-test.mjs:46"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/tui-test.mjs","line":142,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/tui-test.mjs:142"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/ui-preview.mjs","line":295,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/ui-preview.mjs:295"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/updater-test.mjs","line":564,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/updater-test.mjs:564"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/updater-test.mjs","line":564,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/updater-test.mjs:564"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/updater-test.mjs","line":564,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/updater-test.mjs:564"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/updater-test.mjs","line":564,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/updater-test.mjs:564"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/updater-test.mjs","line":565,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/updater-test.mjs:565"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/updater-test.mjs","line":565,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/updater-test.mjs:565"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/updater-test.mjs","line":565,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/updater-test.mjs:565"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/updater-test.mjs","line":599,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/updater-test.mjs:599"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/vault-test.mjs","line":201,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/vault-test.mjs:201"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/vault-test.mjs","line":205,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/vault-test.mjs:205"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/workbench-management-test.mjs","line":38,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/workbench-management-test.mjs:38"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/workbench-management-test.mjs","line":60,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/workbench-management-test.mjs:60"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/workbench-native-desktop-test.mjs","line":45,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/workbench-native-desktop-test.mjs:45"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/workbench-native-desktop-test.mjs","line":337,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/workbench-native-desktop-test.mjs:337"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/workbench-native-desktop-test.mjs","line":356,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/workbench-native-desktop-test.mjs:356"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/magpie-engine.js","line":929,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/magpie-engine.js:929"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"src/magpie-engine.js","line":1111,"fingerprint":"javascript.lang.correctness.no-stringify-keys:src/magpie-engine.js:1111"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"src/open-external.js","line":30,"fingerprint":"javascript.lang.correctness.no-replaceall:src/open-external.js:30"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"worker/auth-github.mjs","line":132,"fingerprint":"javascript.lang.correctness.no-replaceall:worker/auth-github.mjs:132"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"worker/auth-github.mjs","line":132,"fingerprint":"javascript.lang.correctness.no-replaceall:worker/auth-github.mjs:132"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"worker/auth-github.mjs","line":132,"fingerprint":"javascript.lang.correctness.no-replaceall:worker/auth-github.mjs:132"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"worker/auth-github.mjs","line":132,"fingerprint":"javascript.lang.correctness.no-replaceall:worker/auth-github.mjs:132"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"worker/auth-github.mjs","line":132,"fingerprint":"javascript.lang.correctness.no-replaceall:worker/auth-github.mjs:132"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"client.js","line":1800,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:client.js:1800"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"client.js","line":1800,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:client.js:1800"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"client.js","line":4081,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:client.js:4081"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"client.js","line":4081,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:client.js:4081"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"client.js","line":5425,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:client.js:5425"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"client.js","line":5425,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:client.js:5425"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"client.js","line":5425,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:client.js:5425"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"client.js","line":7179,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:client.js:7179"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"client.js","line":7179,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:client.js:7179"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"index.js","line":2567,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:index.js:2567"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"index.js","line":2567,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:index.js:2567"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"index.js","line":2577,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:index.js:2577"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"index.js","line":2577,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:index.js:2577"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"index.js","line":2588,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:index.js:2588"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"index.js","line":2588,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:index.js:2588"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"index.js","line":2595,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:index.js:2595"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"index.js","line":2595,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:index.js:2595"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/client-terminal.mjs","line":273,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/client-terminal.mjs:273"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/client-terminal.mjs","line":273,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/client-terminal.mjs:273"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/client-terminal.mjs","line":279,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/client-terminal.mjs:279"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/client-terminal.mjs","line":298,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/client-terminal.mjs:298"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/frontend/app.tsx","line":36,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/frontend/app.tsx:36"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/frontend/app.tsx","line":36,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/frontend/app.tsx:36"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/frontend/connection.tsx","line":18,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/frontend/connection.tsx:18"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/frontend/connection.tsx","line":18,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/frontend/connection.tsx:18"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/frontend/connection.tsx","line":18,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/frontend/connection.tsx:18"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`f` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":2,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:2"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`e` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":2,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:2"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`t` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":2,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:2"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`l` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`An` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`l` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.eqeq-is-bad","severity":"low","message":"Detected a useless comparison operation `wl == wl` or `wl != wl`. This operation is always true. If testing for floating point NaN, use `math.isnan`, or `cmath.isnan` if the number is complex.","path":"packages/standalone/web/app.js","line":9,"fingerprint":"javascript.lang.correctness.eqeq-is-bad:packages/standalone/web/app.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`Xo` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`a` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`r` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`s` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`t` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`t` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`a` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`a` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`a` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`qe` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`a` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`e` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`r` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`a` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":9,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`f` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":10,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:10"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`O` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":10,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:10"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`h` is assigned twice; the first assignment is useless","path":"packages/standalone/web/app.js","line":10,"fingerprint":"javascript.lang.correctness.useless-assignment:packages/standalone/web/app.js:10"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/app.js","line":13,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/app.js:13"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/app.js","line":13,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/app.js:13"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/app.js","line":13,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/app.js:13"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/app.js","line":15,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/app.js:15"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/app.js","line":15,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/app.js:15"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/app.js","line":19,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/app.js:19"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/app.js","line":19,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/app.js:19"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/channels-CqFHCMz8.js","line":1,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/channels-CqFHCMz8.js:1"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/channels-CqFHCMz8.js","line":1,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/channels-CqFHCMz8.js:1"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/channels-CqFHCMz8.js","line":1149,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/channels-CqFHCMz8.js:1149"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/channels-CqFHCMz8.js","line":1149,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/channels-CqFHCMz8.js:1149"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/channels-CqFHCMz8.js","line":1149,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/channels-CqFHCMz8.js:1149"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/channels-CqFHCMz8.js","line":1149,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/channels-CqFHCMz8.js:1149"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/channels-CqFHCMz8.js","line":1149,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/channels-CqFHCMz8.js:1149"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/channels-CqFHCMz8.js","line":1149,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/channels-CqFHCMz8.js:1149"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/channels-CqFHCMz8.js","line":1149,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/channels-CqFHCMz8.js:1149"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/channels-CqFHCMz8.js","line":1149,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/channels-CqFHCMz8.js:1149"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/channels-CqFHCMz8.js","line":1149,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/channels-CqFHCMz8.js:1149"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/channels-CqFHCMz8.js","line":1149,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/channels-CqFHCMz8.js:1149"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/channels-CqFHCMz8.js","line":1149,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/channels-CqFHCMz8.js:1149"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/channels-CqFHCMz8.js","line":1149,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/channels-CqFHCMz8.js:1149"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/channels-CqFHCMz8.js","line":1149,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/channels-CqFHCMz8.js:1149"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/channels-CqFHCMz8.js","line":1149,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/channels-CqFHCMz8.js:1149"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/models-ChmCQDPX.js","line":1,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/models-ChmCQDPX.js:1"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/standalone/web/models-ChmCQDPX.js","line":1,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/standalone/web/models-ChmCQDPX.js:1"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/build-magpie-engine.mjs","line":77,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/build-magpie-engine.mjs:77"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/build-magpie-engine.mjs","line":77,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/build-magpie-engine.mjs:77"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/build-manifest.mjs","line":214,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/build-manifest.mjs:214"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/build-manifest.mjs","line":214,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/build-manifest.mjs:214"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/build-sponsor.mjs","line":9,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/build-sponsor.mjs:9"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/build-sponsor.mjs","line":9,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/build-sponsor.mjs:9"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`response` is assigned twice; the first assignment is useless","path":"scripts/chan-relay-test.mjs","line":99,"fingerprint":"javascript.lang.correctness.useless-assignment:scripts/chan-relay-test.mjs:99"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/channel-network-test.mjs","line":185,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/channel-network-test.mjs:185"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/channel-network-test.mjs","line":185,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/channel-network-test.mjs:185"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/channel-network-test.mjs","line":185,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/channel-network-test.mjs:185"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/channel-network-test.mjs","line":185,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/channel-network-test.mjs:185"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/channel-network-test.mjs","line":185,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/channel-network-test.mjs:185"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/channel-network-test.mjs","line":185,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/channel-network-test.mjs:185"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/channel-network-test.mjs","line":185,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/channel-network-test.mjs:185"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/channel-network-test.mjs","line":185,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/channel-network-test.mjs:185"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/channel-pack-test.mjs","line":25,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/channel-pack-test.mjs:25"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/channel-pack-test.mjs","line":417,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/channel-pack-test.mjs:417"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/channel-pack-test.mjs","line":417,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/channel-pack-test.mjs:417"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/channel-pack-test.mjs","line":813,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/channel-pack-test.mjs:813"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/channel-pack-test.mjs","line":813,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/channel-pack-test.mjs:813"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/channel-pack-test.mjs","line":817,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/channel-pack-test.mjs:817"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/channel-pack-test.mjs","line":817,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/channel-pack-test.mjs:817"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/client-terminal-test.mjs","line":315,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/client-terminal-test.mjs:315"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/client-terminal-test.mjs","line":315,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/client-terminal-test.mjs:315"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/client-terminal-test.mjs","line":367,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/client-terminal-test.mjs:367"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/client-terminal-test.mjs","line":367,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/client-terminal-test.mjs:367"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/desktop-test.mjs","line":19,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/desktop-test.mjs:19"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/desktop-test.mjs","line":19,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/desktop-test.mjs:19"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/eac-auth-test.mjs","line":68,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/eac-auth-test.mjs:68"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/eac-auth-test.mjs","line":68,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/eac-auth-test.mjs:68"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/eac-auth-test.mjs","line":68,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/eac-auth-test.mjs:68"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/eac-auth-test.mjs","line":68,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/eac-auth-test.mjs:68"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/eac-auth-test.mjs","line":68,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/eac-auth-test.mjs:68"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":99848.0,"test_ratio":0.0,"ci_files":5.0,"cochange_share":0.0,"cochange_commits":168.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/build-macos.yml","ref":".github/workflows/build-macos.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/build-windows.yml","ref":".github/workflows/build-windows.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/prepare-release.yml","ref":".github/workflows/prepare-release.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release-sign.yml","ref":".github/workflows/release-sign.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/test.yml","ref":".github/workflows/test.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm run test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm run test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":582.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.9489,"check:low_escape_density":1.0,"escapes":3.0,"escapes_per_kloc":0.852},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: packages/standalone/tsconfig.json","ref":"packages/standalone/tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":759.0,"other_lines":99089.0,"files_blamed":353.0,"blame_failures":0.0,"quality:ai_findings":2.0,"quality:ai_per_kloc":2.635,"quality:other_findings":198.0,"quality:other_per_kloc":1.998,"quality:ratio":1.32,"security:ai_findings":0.0,"security:ai_per_kloc":0.0,"security:other_findings":77.0,"security:other_per_kloc":0.777,"security:ratio":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}