{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T15:33:07.171545Z","repo":{"ref":{"host":"github.com","owner":"FiloSottile","name":"mkcert"},"default_branch":"master","clone_url":"https://github.com/FiloSottile/mkcert.git","html_url":"https://github.com/FiloSottile/mkcert","description":"A simple zero-config tool to make locally trusted development certificates with any names you'd like.","stars":59855,"forks":3257,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":1799,"primary_language":"Go","license_spdx":"BSD-3-Clause","created_at":"2018-06-25T05:33:03Z","pushed_at":"2024-08-13T13:37:46Z","security_policy_url":"https://github.com/FiloSottile/mkcert/security/policy","distribution":{"owner_created_at":"2011-11-28T13:06:49Z","owner_type":"User","release_assets":[{"name":"mkcert-v1.4.4-darwin-amd64","size":5303728,"download_count":384320,"release_tag":"v1.4.4","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-darwin-amd64"},{"name":"mkcert-v1.4.4-darwin-arm64","size":5174450,"download_count":784854,"release_tag":"v1.4.4","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-darwin-arm64"},{"name":"mkcert-v1.4.4-linux-amd64","size":4788866,"download_count":14614943,"release_tag":"v1.4.4","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-linux-amd64"},{"name":"mkcert-v1.4.4-linux-arm","size":4763091,"download_count":12917,"release_tag":"v1.4.4","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-linux-arm"},{"name":"mkcert-v1.4.4-linux-arm64","size":4633188,"download_count":1122994,"release_tag":"v1.4.4","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-linux-arm64"},{"name":"mkcert-v1.4.4-windows-amd64.exe","size":4896256,"download_count":953386,"release_tag":"v1.4.4","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-windows-amd64.exe"},{"name":"mkcert-v1.4.4-windows-arm64.exe","size":4642304,"download_count":94343,"release_tag":"v1.4.4","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-windows-arm64.exe"},{"name":"mkcert-v1.4.3-darwin-amd64","size":5330600,"download_count":32963,"release_tag":"v1.4.3","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.3/mkcert-v1.4.3-darwin-amd64"},{"name":"mkcert-v1.4.3-linux-amd64","size":4803796,"download_count":3579843,"release_tag":"v1.4.3","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.3/mkcert-v1.4.3-linux-amd64"},{"name":"mkcert-v1.4.3-linux-arm","size":4356543,"download_count":19513,"release_tag":"v1.4.3","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.3/mkcert-v1.4.3-linux-arm"},{"name":"mkcert-v1.4.3-linux-arm64","size":4594656,"download_count":26533,"release_tag":"v1.4.3","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.3/mkcert-v1.4.3-linux-arm64"},{"name":"mkcert-v1.4.3-windows-amd64.exe","size":4957184,"download_count":96773,"release_tag":"v1.4.3","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.3/mkcert-v1.4.3-windows-amd64.exe"},{"name":"mkcert-v1.4.2-darwin-amd64","size":5346888,"download_count":1274,"release_tag":"v1.4.2","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.2/mkcert-v1.4.2-darwin-amd64"},{"name":"mkcert-v1.4.2-linux-amd64","size":4824262,"download_count":34140,"release_tag":"v1.4.2","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.2/mkcert-v1.4.2-linux-amd64"},{"name":"mkcert-v1.4.2-linux-arm","size":4356537,"download_count":364,"release_tag":"v1.4.2","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.2/mkcert-v1.4.2-linux-arm"},{"name":"mkcert-v1.4.2-linux-arm64","size":4594642,"download_count":1521,"release_tag":"v1.4.2","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.2/mkcert-v1.4.2-linux-arm64"},{"name":"mkcert-v1.4.2-windows-amd64.exe","size":4975104,"download_count":2990,"release_tag":"v1.4.2","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.2/mkcert-v1.4.2-windows-amd64.exe"},{"name":"mkcert-v1.4.1-darwin-amd64","size":5551192,"download_count":76375,"release_tag":"v1.4.1","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.1/mkcert-v1.4.1-darwin-amd64"},{"name":"mkcert-v1.4.1-linux-amd64","size":4931025,"download_count":1196190,"release_tag":"v1.4.1","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.1/mkcert-v1.4.1-linux-amd64"},{"name":"mkcert-v1.4.1-linux-arm","size":4417963,"download_count":8550,"release_tag":"v1.4.1","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.1/mkcert-v1.4.1-linux-arm"},{"name":"mkcert-v1.4.1-windows-amd64.exe","size":5038080,"download_count":93182,"release_tag":"v1.4.1","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.1/mkcert-v1.4.1-windows-amd64.exe"},{"name":"mkcert-v1.4.0-darwin-amd64","size":5493376,"download_count":10498,"release_tag":"v1.4.0","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.0/mkcert-v1.4.0-darwin-amd64"},{"name":"mkcert-v1.4.0-linux-amd64","size":4834721,"download_count":113089,"release_tag":"v1.4.0","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.0/mkcert-v1.4.0-linux-amd64"},{"name":"mkcert-v1.4.0-linux-arm","size":4394215,"download_count":1729,"release_tag":"v1.4.0","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.0/mkcert-v1.4.0-linux-arm"},{"name":"mkcert-v1.4.0-windows-amd64.exe","size":4894208,"download_count":8492,"release_tag":"v1.4.0","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.0/mkcert-v1.4.0-windows-amd64.exe"},{"name":"mkcert-v1.3.0-darwin-amd64","size":5032408,"download_count":4756,"release_tag":"v1.3.0","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.3.0/mkcert-v1.3.0-darwin-amd64"},{"name":"mkcert-v1.3.0-linux-amd64","size":4494004,"download_count":114010,"release_tag":"v1.3.0","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.3.0/mkcert-v1.3.0-linux-amd64"},{"name":"mkcert-v1.3.0-linux-arm","size":3979439,"download_count":4464,"release_tag":"v1.3.0","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.3.0/mkcert-v1.3.0-linux-arm"},{"name":"mkcert-v1.3.0-windows-amd64.exe","size":4505600,"download_count":90235,"release_tag":"v1.3.0","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.3.0/mkcert-v1.3.0-windows-amd64.exe"},{"name":"mkcert-v1.2.0-darwin-amd64","size":5011128,"download_count":1243,"release_tag":"v1.2.0","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.2.0/mkcert-v1.2.0-darwin-amd64"},{"name":"mkcert-v1.2.0-linux-amd64","size":4468473,"download_count":619837,"release_tag":"v1.2.0","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.2.0/mkcert-v1.2.0-linux-amd64"},{"name":"mkcert-v1.2.0-windows-amd64.exe","size":4481024,"download_count":5560,"release_tag":"v1.2.0","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.2.0/mkcert-v1.2.0-windows-amd64.exe"},{"name":"mkcert-v1.1.2-darwin-amd64","size":4994248,"download_count":1401,"release_tag":"v1.1.2","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.1.2/mkcert-v1.1.2-darwin-amd64"},{"name":"mkcert-v1.1.2-linux-amd64","size":4455604,"download_count":197300,"release_tag":"v1.1.2","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.1.2/mkcert-v1.1.2-linux-amd64"},{"name":"mkcert-v1.1.2-windows-amd64.exe","size":4466688,"download_count":5430,"release_tag":"v1.1.2","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.1.2/mkcert-v1.1.2-windows-amd64.exe"},{"name":"mkcert-v1.1.1-darwin-amd64","size":5068064,"download_count":454,"release_tag":"v1.1.1","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.1.1/mkcert-v1.1.1-darwin-amd64"},{"name":"mkcert-v1.1.1-linux-amd64","size":4536300,"download_count":1359,"release_tag":"v1.1.1","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.1.1/mkcert-v1.1.1-linux-amd64"},{"name":"mkcert-v1.1.1-windows-amd64.exe","size":4547072,"download_count":799,"release_tag":"v1.1.1","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.1.1/mkcert-v1.1.1-windows-amd64.exe"},{"name":"mkcert-v1.1.0-darwin-amd64","size":5076336,"download_count":768,"release_tag":"v1.1.0","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.1.0/mkcert-v1.1.0-darwin-amd64"},{"name":"mkcert-v1.1.0-linux-amd64","size":4544368,"download_count":1227,"release_tag":"v1.1.0","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.1.0/mkcert-v1.1.0-linux-amd64"},{"name":"mkcert-v1.1.0-windows-amd64.exe","size":4553728,"download_count":3323,"release_tag":"v1.1.0","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.1.0/mkcert-v1.1.0-windows-amd64.exe"}]}},"commit_sha":"1c1dc4ed27ed5936046b6398d39cab4d657a2d8e","profile":{"lines_by_language":{"Go":1381},"files_by_category":{"source":7,"docs":3,"config":3,"other":2,"generated":1},"source_lines":1381,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"possible","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0,"style_index":9.051},"summary":"Weak signals consistent with AI-assisted development. Comments and strings use phrasing typical of LLM-written code (see the coding style evidence)."},"quality":{"score":49.7,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":51.4,"duplication":92.9,"lint":40.4,"testing":35.8,"docs":65.0,"type_safety":null,"process":15.0},"summary":"Code quality is poor: test-to-source ratio 0.00, CI runs tests; 22% of function code in complex or long functions; 1% duplicated lines. Weakest area: process."},"security":{"score":49.0,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":96.7,"sast":9.1,"dependencies":59.7,"ci_actions":30.7,"posture":40.0,"scorecard":25.0},"summary":"Security posture is poor: 54 known vulnerabilities in 3 dependencies; 9 high-severity SAST findings; 6 high-severity workflow issues. Weakest area: sast."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"ok","tool_version":"scorecard v5.6.0","metrics":{"aggregate":3.3,"check:Binary-Artifacts":10.0,"check:Code-Review":3.0,"check:Dangerous-Workflow":10.0,"check:Maintained":0.0,"check:Token-Permissions":0.0,"check:Pinned-Dependencies":0.0,"check:CII-Best-Practices":0.0,"check:Fuzzing":0.0,"check:License":10.0,"check:Signed-Releases":0.0,"check:Branch-Protection":0.0,"check:Security-Policy":9.0,"check:SAST":0.0},"findings":[],"evidence":[{"kind":"scorecard-check","description":"Scorecard Binary-Artifacts: 10/10 (no binaries found in the repo)","ref":"Binary-Artifacts","url":"https://scorecard.dev/viewer/?uri=github.com/FiloSottile/mkcert","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Code-Review: 3/10 (Found 9/30 approved changesets -- score normalized to 3)","ref":"Code-Review","url":"https://scorecard.dev/viewer/?uri=github.com/FiloSottile/mkcert","weight":0.7},{"kind":"scorecard-check","description":"Scorecard Dangerous-Workflow: 10/10 (no dangerous workflow patterns detected)","ref":"Dangerous-Workflow","url":"https://scorecard.dev/viewer/?uri=github.com/FiloSottile/mkcert","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Maintained: 0/10 (0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0)","ref":"Maintained","url":"https://scorecard.dev/viewer/?uri=github.com/FiloSottile/mkcert","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Token-Permissions: 0/10 (detected GitHub workflow tokens with excessive permissions)","ref":"Token-Permissions","url":"https://scorecard.dev/viewer/?uri=github.com/FiloSottile/mkcert","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Pinned-Dependencies: 0/10 (dependency not pinned by hash detected -- score normalized to 0)","ref":"Pinned-Dependencies","url":"https://scorecard.dev/viewer/?uri=github.com/FiloSottile/mkcert","weight":1.0},{"kind":"scorecard-check","description":"Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)","ref":"CII-Best-Practices","url":"https://scorecard.dev/viewer/?uri=github.com/FiloSottile/mkcert","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Fuzzing: 0/10 (project is not fuzzed)","ref":"Fuzzing","url":"https://scorecard.dev/viewer/?uri=github.com/FiloSottile/mkcert","weight":1.0},{"kind":"scorecard-check","description":"Scorecard License: 10/10 (license file detected)","ref":"License","url":"https://scorecard.dev/viewer/?uri=github.com/FiloSottile/mkcert","weight":0.0},{"kind":"scorecard-check","description":"Scorecard Signed-Releases: 0/10 (Project has not signed or included provenance with any releases.)","ref":"Signed-Releases","url":"https://scorecard.dev/viewer/?uri=github.com/FiloSottile/mkcert","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Branch-Protection: 0/10 (branch protection not enabled on development/release branches)","ref":"Branch-Protection","url":"https://scorecard.dev/viewer/?uri=github.com/FiloSottile/mkcert","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Security-Policy: 9/10 (security policy file detected)","ref":"Security-Policy","url":"https://scorecard.dev/viewer/?uri=github.com/FiloSottile/mkcert","weight":0.1},{"kind":"scorecard-check","description":"Scorecard SAST: 0/10 (SAST tool is not run on all commits -- score normalized to 0)","ref":"SAST","url":"https://scorecard.dev/viewer/?uri=github.com/FiloSottile/mkcert","weight":1.0}],"data":{"date":"2026-11-09","commit":"1c1dc4ed27ed5936046b6398d39cab4d657a2d8e","matches_head":true},"error":null},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":165.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":2180.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2018-06":{"loc":683,"attributed_loc":0},"2018-07":{"loc":401,"attributed_loc":0},"2018-08":{"loc":244,"attributed_loc":0},"2018-10":{"loc":123,"attributed_loc":0},"2018-11":{"loc":4,"attributed_loc":0},"2018-12":{"loc":1,"attributed_loc":0},"2019-01":{"loc":57,"attributed_loc":0},"2019-02":{"loc":215,"attributed_loc":0},"2019-03":{"loc":0,"attributed_loc":0},"2019-04":{"loc":16,"attributed_loc":0},"2019-05":{"loc":0,"attributed_loc":0},"2019-06":{"loc":98,"attributed_loc":0},"2019-07":{"loc":19,"attributed_loc":0},"2019-08":{"loc":66,"attributed_loc":0},"2019-09":{"loc":17,"attributed_loc":0},"2019-11":{"loc":115,"attributed_loc":0},"2019-12":{"loc":0,"attributed_loc":0},"2020-03":{"loc":14,"attributed_loc":0},"2020-10":{"loc":62,"attributed_loc":0},"2020-11":{"loc":23,"attributed_loc":0},"2021-02":{"loc":0,"attributed_loc":0},"2022-04":{"loc":22,"attributed_loc":0},"2024-04":{"loc":0,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"work_units":68.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":2158.0,"pre_ai_era_burst_loc":0.0,"measured_loc":2180.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":80.0,"median_loc_per_hour":30.75,"pr_timed_units":29.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"releases":13.0,"flagged_releases":0.0,"max_loc_per_day":23.0},"findings":[],"evidence":[],"data":{"releases":[{"from":"v0.9.0","to":"v0.9.1","loc":3,"days":0.52,"loc_per_day":5.8,"flagged":false},{"from":"v0.9.1","to":"v1.0.0","loc":10,"days":2.3,"loc_per_day":4.4,"flagged":false},{"from":"v1.0.0","to":"v1.0.1","loc":49,"days":23.07,"loc_per_day":2.1,"flagged":false},{"from":"v1.0.1","to":"v1.1.0","loc":324,"days":14.11,"loc_per_day":23.0,"flagged":false},{"from":"v1.1.0","to":"v1.1.1","loc":48,"days":6.77,"loc_per_day":7.1,"flagged":false},{"from":"v1.1.1","to":"v1.1.2","loc":9,"days":5.95,"loc_per_day":1.5,"flagged":false},{"from":"v1.1.2","to":"v1.2.0","loc":184,"days":134.09,"loc_per_day":1.4,"flagged":false},{"from":"v1.2.0","to":"v1.3.0","loc":211,"days":26.99,"loc_per_day":7.8,"flagged":false},{"from":"v1.3.0","to":"v1.4.0","loc":138,"days":172.84,"loc_per_day":0.8,"flagged":false},{"from":"v1.4.0","to":"v1.4.1","loc":194,"days":107.14,"loc_per_day":1.8,"flagged":false},{"from":"v1.4.1","to":"v1.4.2","loc":38,"days":351.02,"loc_per_day":0.1,"flagged":false},{"from":"v1.4.2","to":"v1.4.3","loc":65,"days":30.55,"loc_per_day":2.1,"flagged":false},{"from":"v1.4.3","to":"v1.4.4","loc":22,"days":517.19,"loc_per_day":0.0,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":1381.0,"index":9.051,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":25.0,"per_kloc:emoji_in_code":18.103,"files:emoji_in_code":4.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":1.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 060fcce2db); removed from the current tree but still retrievable","path":"vendor/software.sslmate.com/src/go-pkcs12/pkcs12.go","line":395,"fingerprint":"060fcce2db48466c3903803e3a42b2689ace1617:vendor/software.sslmate.com/src/go-pkcs12/pkcs12.go:generic-api-key:395"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":17.0,"findings_high":9.0,"findings_medium":8.0,"findings_low":0.0,"weighted_findings":9.45,"scanned_lines":1381.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"main.go","line":384,"fingerprint":"go.lang.security.audit.dangerous-exec-command:main.go:384"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"main.go","line":390,"fingerprint":"go.lang.security.audit.dangerous-exec-command:main.go:390"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"truststore_java.go","line":70,"fingerprint":"go.lang.security.audit.dangerous-exec-command:truststore_java.go:70"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"truststore_java.go","line":90,"fingerprint":"go.lang.security.audit.dangerous-exec-command:truststore_java.go:90"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"truststore_java.go","line":101,"fingerprint":"go.lang.security.audit.dangerous-exec-command:truststore_java.go:101"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"truststore_nss.go","line":79,"fingerprint":"go.lang.security.audit.dangerous-exec-command:truststore_nss.go:79"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"truststore_nss.go","line":91,"fingerprint":"go.lang.security.audit.dangerous-exec-command:truststore_nss.go:91"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"truststore_nss.go","line":108,"fingerprint":"go.lang.security.audit.dangerous-exec-command:truststore_nss.go:108"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"truststore_nss.go","line":112,"fingerprint":"go.lang.security.audit.dangerous-exec-command:truststore_nss.go:112"},{"rule_id":"opengrep/go.lang.security.audit.crypto.use-of-sha1","severity":"medium","message":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"cert.go","line":325,"fingerprint":"go.lang.security.audit.crypto.use-of-sha1:cert.go:325"},{"rule_id":"opengrep/go.lang.security.audit.crypto.use-of-sha1","severity":"medium","message":"Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"truststore_java.go","line":77,"fingerprint":"go.lang.security.audit.crypto.use-of-sha1:truststore_java.go:77"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"truststore_windows.go","line":76,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:truststore_windows.go:76"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"truststore_windows.go","line":96,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:truststore_windows.go:96"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"truststore_windows.go","line":113,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:truststore_windows.go:113"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"truststore_windows.go","line":114,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:truststore_windows.go:114"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"truststore_windows.go","line":121,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:truststore_windows.go:121"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"truststore_windows.go","line":126,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:truststore_windows.go:126"}],"evidence":[],"data":{"rulesets":["go"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":3.0,"vulnerabilities":54.0,"vulns_critical":8.0,"vulns_high":7.0,"vulns_medium":14.0,"vulns_low":0.0,"vulns_unknown":25.0,"penalty":31.0},"findings":[{"rule_id":"osv/GHSA-v778-237x-gjrc","severity":"critical","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2024-3321, GHSA-v778-237x-gjrc","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GHSA-v778-237x-gjrc"},{"rule_id":"osv/GHSA-jppx-rxg9-jmrx","severity":"critical","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2026-5005, GHSA-jppx-rxg9-jmrx","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GHSA-jppx-rxg9-jmrx"},{"rule_id":"osv/GHSA-f5wc-c3c7-36mc","severity":"critical","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2026-5006, GHSA-f5wc-c3c7-36mc","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GHSA-f5wc-c3c7-36mc"},{"rule_id":"osv/GHSA-vgwf-h737-ff37","severity":"critical","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2026-5017, GHSA-vgwf-h737-ff37","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GHSA-vgwf-h737-ff37"},{"rule_id":"osv/GHSA-89gr-r52h-f8rx","severity":"critical","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2026-5019, GHSA-89gr-r52h-f8rx","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GHSA-89gr-r52h-f8rx"},{"rule_id":"osv/GHSA-rm3j-f69w-wqmq","severity":"critical","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2026-5020, GHSA-rm3j-f69w-wqmq","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GHSA-rm3j-f69w-wqmq"},{"rule_id":"osv/GHSA-5cgq-3rg8-m6cv","severity":"critical","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2026-5021, GHSA-5cgq-3rg8-m6cv","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GHSA-5cgq-3rg8-m6cv"},{"rule_id":"osv/GHSA-x527-x647-q7gg","severity":"critical","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2026-5023, GHSA-x527-x647-q7gg","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GHSA-x527-x647-q7gg"},{"rule_id":"osv/GHSA-hcg3-q754-cr77","severity":"high","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2025-3487, GHSA-hcg3-q754-cr77","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GHSA-hcg3-q754-cr77"},{"rule_id":"osv/GHSA-q4h4-gmj2-qvw2","severity":"high","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2026-5013, GHSA-q4h4-gmj2-qvw2","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GHSA-q4h4-gmj2-qvw2"},{"rule_id":"osv/GHSA-w879-237q-wc7r","severity":"high","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2026-5018, GHSA-w879-237q-wc7r","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GHSA-w879-237q-wc7r"},{"rule_id":"osv/GHSA-69cg-p879-7622","severity":"high","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2022-0969, GHSA-69cg-p879-7622","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GHSA-69cg-p879-7622"},{"rule_id":"osv/GHSA-vvpx-j8f3-3w6h","severity":"high","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2023-1571, GHSA-vvpx-j8f3-3w6h","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GHSA-vvpx-j8f3-3w6h"},{"rule_id":"osv/GHSA-4374-p667-p6c8","severity":"high","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2023-2102, GHSA-4374-p667-p6c8","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GHSA-4374-p667-p6c8"},{"rule_id":"osv/GHSA-69ch-w2m2-3vjp","severity":"high","message":"golang.org/x/text@0.3.7 (Go) is affected by GO-2022-1059, GHSA-69ch-w2m2-3vjp","path":"go.mod","line":null,"fingerprint":"golang.org/x/text@0.3.7 (Go):GHSA-69ch-w2m2-3vjp"},{"rule_id":"osv/GHSA-45x7-px36-x8w8","severity":"medium","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2023-2402, GHSA-45x7-px36-x8w8","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GHSA-45x7-px36-x8w8"},{"rule_id":"osv/GO-2024-2961","severity":"medium","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2024-2961","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GO-2024-2961"},{"rule_id":"osv/GO-2025-4116","severity":"medium","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2025-4116","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GO-2025-4116"},{"rule_id":"osv/GHSA-j5w8-q4qc-rx2x","severity":"medium","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2025-4134, GHSA-j5w8-q4qc-rx2x","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GHSA-j5w8-q4qc-rx2x"},{"rule_id":"osv/GHSA-f6x5-jh6r-wrfv","severity":"medium","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2025-4135, GHSA-f6x5-jh6r-wrfv","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GHSA-f6x5-jh6r-wrfv"},{"rule_id":"osv/GHSA-45gg-vh54-h5m9","severity":"medium","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2026-5014, GHSA-45gg-vh54-h5m9","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GHSA-45gg-vh54-h5m9"},{"rule_id":"osv/GHSA-78mq-xcr3-xm33","severity":"medium","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2026-5015, GHSA-78mq-xcr3-xm33","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GHSA-78mq-xcr3-xm33"},{"rule_id":"osv/GHSA-qpw4-5x99-6vjp","severity":"medium","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2026-5016, GHSA-qpw4-5x99-6vjp","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GHSA-qpw4-5x99-6vjp"},{"rule_id":"osv/GHSA-9m57-25v3-79x9","severity":"medium","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2026-5033, GHSA-9m57-25v3-79x9","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GHSA-9m57-25v3-79x9"},{"rule_id":"osv/GO-2026-5932","severity":"medium","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2026-5932","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GO-2026-5932"},{"rule_id":"osv/GO-2026-6303","severity":"medium","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2026-6303","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GO-2026-6303"},{"rule_id":"osv/GO-2026-6354","severity":"medium","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2026-6354","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GO-2026-6354"},{"rule_id":"osv/GO-2026-6355","severity":"medium","message":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go) is affected by GO-2026-6355","path":"go.mod","line":null,"fingerprint":"golang.org/x/crypto@0.0.0-20220331220935-ae2d96664a29 (Go):GO-2026-6355"},{"rule_id":"osv/GHSA-xrjj-mj9h-534m","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2022-1144, GHSA-xrjj-mj9h-534m","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GHSA-xrjj-mj9h-534m"},{"rule_id":"osv/GHSA-2wrh-6pvc-2jm9","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2023-1988, GHSA-2wrh-6pvc-2jm9","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GHSA-2wrh-6pvc-2jm9"},{"rule_id":"osv/GHSA-4v7x-pqxf-cx7m","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2024-2687, GHSA-4v7x-pqxf-cx7m","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GHSA-4v7x-pqxf-cx7m"},{"rule_id":"osv/GO-2024-3333","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2024-3333","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GO-2024-3333"},{"rule_id":"osv/GHSA-qxp5-gwg8-xv66","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2025-3503, GHSA-qxp5-gwg8-xv66","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GHSA-qxp5-gwg8-xv66"},{"rule_id":"osv/GHSA-vvgc-356p-c3xw","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2025-3595, GHSA-vvgc-356p-c3xw","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GHSA-vvgc-356p-c3xw"},{"rule_id":"osv/GO-2026-4440","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2026-4440","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GO-2026-4440"},{"rule_id":"osv/GO-2026-4441","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2026-4441","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GO-2026-4441"},{"rule_id":"osv/GO-2026-4918","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2026-4918","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GO-2026-4918"},{"rule_id":"osv/GO-2026-5025","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2026-5025","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GO-2026-5025"},{"rule_id":"osv/GO-2026-5026","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2026-5026","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GO-2026-5026"},{"rule_id":"osv/GO-2026-5027","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2026-5027","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GO-2026-5027"},{"rule_id":"osv/GHSA-5cv4-jp36-h3mw","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2026-5028, GHSA-5cv4-jp36-h3mw","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GHSA-5cv4-jp36-h3mw"},{"rule_id":"osv/GO-2026-5029","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2026-5029","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GO-2026-5029"},{"rule_id":"osv/GO-2026-5030","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2026-5030","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GO-2026-5030"},{"rule_id":"osv/GO-2026-5942","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2026-5942","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GO-2026-5942"},{"rule_id":"osv/GO-2026-6603","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2026-6603","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GO-2026-6603"},{"rule_id":"osv/GO-2026-6610","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2026-6610","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GO-2026-6610"},{"rule_id":"osv/GO-2026-6611","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2026-6611","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GO-2026-6611"},{"rule_id":"osv/GO-2026-6612","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2026-6612","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GO-2026-6612"},{"rule_id":"osv/GO-2026-6617","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2026-6617","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GO-2026-6617"},{"rule_id":"osv/GO-2026-6860","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2026-6860","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GO-2026-6860"},{"rule_id":"osv/GO-2026-6866","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GO-2026-6866","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GO-2026-6866"},{"rule_id":"osv/GHSA-qppj-fm5r-hxr3","severity":"medium","message":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go) is affected by GHSA-qppj-fm5r-hxr3","path":"go.mod","line":null,"fingerprint":"golang.org/x/net@0.0.0-20220421235706-1d1ef9303861 (Go):GHSA-qppj-fm5r-hxr3"},{"rule_id":"osv/GO-2026-5970","severity":"medium","message":"golang.org/x/text@0.3.7 (Go) is affected by GO-2026-5970","path":"go.mod","line":null,"fingerprint":"golang.org/x/text@0.3.7 (Go):GO-2026-5970"},{"rule_id":"osv/GO-2026-6629","severity":"medium","message":"golang.org/x/text@0.3.7 (Go) is affected by GO-2026-6629","path":"go.mod","line":null,"fingerprint":"golang.org/x/text@0.3.7 (Go):GO-2026-6629"}],"evidence":[],"data":{"ecosystems":["Go"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":2.0,"findings":10.0,"findings_high":6.0,"findings_medium":4.0,"findings_low":0.0,"penalty":70.8},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":11,"fingerprint":"unpinned-uses:.github/workflows/release.yml:11"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":15,"fingerprint":"unpinned-uses:.github/workflows/release.yml:15"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":26,"fingerprint":"unpinned-uses:.github/workflows/release.yml:26"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":11,"fingerprint":"cache-poisoning:.github/workflows/release.yml:11"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":13,"fingerprint":"unpinned-uses:.github/workflows/test.yml:13"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/test.yml","line":17,"fingerprint":"unpinned-uses:.github/workflows/test.yml:17"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":14,"fingerprint":"artipacked:.github/workflows/release.yml:14"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/release.yml","line":6,"fingerprint":"excessive-permissions:.github/workflows/release.yml:6"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/test.yml","line":16,"fingerprint":"artipacked:.github/workflows/test.yml:16"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/test.yml","line":4,"fingerprint":"excessive-permissions:.github/workflows/test.yml:4"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.1879,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: https://github.com/FiloSottile/mkcert/security/policy","ref":"https://github.com/FiloSottile/mkcert/security/policy","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":11.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v1.4.4 ships mkcert-v1.4.4-windows-amd64.exe (953386 downloads)","ref":"mkcert-v1.4.4-windows-amd64.exe","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-windows-amd64.exe","weight":0.0},{"kind":"binary-release-asset","description":"release v1.4.4 ships mkcert-v1.4.4-windows-arm64.exe (94343 downloads)","ref":"mkcert-v1.4.4-windows-arm64.exe","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-windows-arm64.exe","weight":0.0},{"kind":"binary-release-asset","description":"release v1.4.3 ships mkcert-v1.4.3-windows-amd64.exe (96773 downloads)","ref":"mkcert-v1.4.3-windows-amd64.exe","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.3/mkcert-v1.4.3-windows-amd64.exe","weight":0.0},{"kind":"binary-release-asset","description":"release v1.4.2 ships mkcert-v1.4.2-windows-amd64.exe (2990 downloads)","ref":"mkcert-v1.4.2-windows-amd64.exe","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.2/mkcert-v1.4.2-windows-amd64.exe","weight":0.0},{"kind":"binary-release-asset","description":"release v1.4.1 ships mkcert-v1.4.1-windows-amd64.exe (93182 downloads)","ref":"mkcert-v1.4.1-windows-amd64.exe","url":"https://github.com/FiloSottile/mkcert/releases/download/v1.4.1/mkcert-v1.4.1-windows-amd64.exe","weight":0.0}],"data":{"signals":["binary-release-assets"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":51.0,"function_nloc":905.0,"mean_ccn":4.8,"p90_ccn":10.0,"complex_functions":3.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.2221},"findings":[],"evidence":[{"kind":"complex-function","description":"Run in main.go: complexity 26, 63 lines","ref":"main.go","url":"https://github.com/FiloSottile/mkcert/blob/1c1dc4ed27ed5936046b6398d39cab4d657a2d8e/main.go#L171","weight":0.43333333333333335},{"kind":"complex-function","description":"makeCert in cert.go: complexity 19, 77 lines","ref":"cert.go","url":"https://github.com/FiloSottile/mkcert/blob/1c1dc4ed27ed5936046b6398d39cab4d657a2d8e/cert.go#L50","weight":0.31666666666666665},{"kind":"complex-function","description":"main in main.go: complexity 17, 61 lines","ref":"main.go","url":"https://github.com/FiloSottile/mkcert/blob/1c1dc4ed27ed5936046b6398d39cab4d657a2d8e/main.go#L87","weight":0.2833333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":979.0,"duplicated_lines":12.0,"duplicated_share":0.0123,"files":7.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: truststore_java.go:14 and truststore_nss.go:10","ref":"truststore_java.go","url":"https://github.com/FiloSottile/mkcert/blob/1c1dc4ed27ed5936046b6398d39cab4d657a2d8e/truststore_java.go#L14","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":5.0,"weighted_findings":5.0,"scanned_lines":1381.0,"category:correctness":5.0},"findings":[{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"cert.go","line":119,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:cert.go:119"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"cert.go","line":128,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:cert.go:128"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"cert.go","line":271,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:cert.go:271"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"cert.go","line":360,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:cert.go:360"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"main.go","line":176,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:main.go:176"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0784,"test_lines":0.0,"source_lines":1381.0,"test_ratio":0.0,"ci_files":2.0,"cochange_share":0.0196,"cochange_commits":102.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/test.yml","ref":".github/workflows/test.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (go test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["go test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":133.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}