{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:00.693141Z","repo":{"ref":{"host":"github.com","owner":"ItsNotCam","name":"june"},"default_branch":"main","clone_url":"https://github.com/ItsNotCam/june.git","html_url":"https://github.com/ItsNotCam/june","description":null,"stars":0,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":3344,"primary_language":"TypeScript","license_spdx":null,"created_at":"2026-04-17T02:02:45Z","pushed_at":"2026-06-21T21:28:45Z","security_policy_url":null,"distribution":{"owner_created_at":"2018-12-20T03:42:46Z","owner_type":"User","release_assets":[]}},"commit_sha":"a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08","profile":{"lines_by_language":{"TypeScript":41682,"JavaScript":792,"Shell":373,"SQL":147,"Python":36},"files_by_category":{"source":243,"docs":216,"test":86,"config":65,"other":15,"binary":3,"generated":1},"source_lines":32015,"test_lines":11015},"pillars":{"ai_provenance":{"score":29.6,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.2962,"suspected_share":0.4957,"estimated_share":0.2962,"ai_artifacts":45.0,"flagged_work_units":7.0,"flagged_releases":null,"style_index":0.328},"summary":"Explicit AI attribution on 30% of first-party code added; an estimated 30% including velocity signals."},"quality":{"score":72.1,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":62.7,"duplication":81.0,"lint":71.2,"testing":82.2,"docs":40.0,"type_safety":99.9,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.34, CI runs tests; 16% of function code in complex or long functions; 4% duplicated lines. Weakest area: docs."},"security":{"score":46.8,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":100.0,"sast":35.2,"dependencies":3.2,"ci_actions":63.1,"posture":0.0,"scorecard":null},"summary":"Security posture is poor: 165 known vulnerabilities in 30 dependencies; 19 high-severity SAST findings; 2 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":36.0,"checked":36.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":156.0,"attributed_commits":18.0,"attributed_commit_share":0.11538461538461539,"effective_loc":53985.0,"attributed_loc":15991.0,"attributed_loc_share":0.2962119107159396,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 18 attributed commits, 15,991 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a1be6b629e62c66d44bf86f7e48f3c4f1d13f4b3","url":"https://github.com/ItsNotCam/june/commit/a1be6b629e62c66d44bf86f7e48f3c4f1d13f4b3","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"1b12b38d6b82b94d3ecbc403f74a8d379724bccd","url":"https://github.com/ItsNotCam/june/commit/1b12b38d6b82b94d3ecbc403f74a8d379724bccd","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"cac750c3b314b5191ffc78703a067cd0685cfd4a","url":"https://github.com/ItsNotCam/june/commit/cac750c3b314b5191ffc78703a067cd0685cfd4a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"21d6c2504cea6e1c9d92472d1dfafcb837b2decd","url":"https://github.com/ItsNotCam/june/commit/21d6c2504cea6e1c9d92472d1dfafcb837b2decd","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"52f5d8e5c50b3dd5bfdfa09b32eb20a17019c5e2","url":"https://github.com/ItsNotCam/june/commit/52f5d8e5c50b3dd5bfdfa09b32eb20a17019c5e2","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"3ea7f1e63bff61043d62a339707445443cd46611","url":"https://github.com/ItsNotCam/june/commit/3ea7f1e63bff61043d62a339707445443cd46611","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"5c254d9e57f16ea052fae7dcb998833c72d8e4d8","url":"https://github.com/ItsNotCam/june/commit/5c254d9e57f16ea052fae7dcb998833c72d8e4d8","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"85de3b7fab7647793f5f9334a67106dfa3a0f2ab","url":"https://github.com/ItsNotCam/june/commit/85de3b7fab7647793f5f9334a67106dfa3a0f2ab","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"53cb8d0e9c1075c678385b5d7702f4d497b62c7d","url":"https://github.com/ItsNotCam/june/commit/53cb8d0e9c1075c678385b5d7702f4d497b62c7d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"9c663637adb851a3e2eb64d76be8283c6605842a","url":"https://github.com/ItsNotCam/june/commit/9c663637adb851a3e2eb64d76be8283c6605842a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"1b444570e6077db29feea7f0de138562794261f3","url":"https://github.com/ItsNotCam/june/commit/1b444570e6077db29feea7f0de138562794261f3","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"a0a04b76b184836d90561a199f04a9bc302c8189","url":"https://github.com/ItsNotCam/june/commit/a0a04b76b184836d90561a199f04a9bc302c8189","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"9a33f6e11e47acb58879094e995fd1cec09acbea","url":"https://github.com/ItsNotCam/june/commit/9a33f6e11e47acb58879094e995fd1cec09acbea","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"ac611fc0f43b11cd4432e62142265e8d6681d525","url":"https://github.com/ItsNotCam/june/commit/ac611fc0f43b11cd4432e62142265e8d6681d525","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"b1975d40b0a0dc47dd79695c69b91cd0bf0355a9","url":"https://github.com/ItsNotCam/june/commit/b1975d40b0a0dc47dd79695c69b91cd0bf0355a9","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"049408f7c23c9625f92ad08966eef99bf450857d","url":"https://github.com/ItsNotCam/june/commit/049408f7c23c9625f92ad08966eef99bf450857d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"0e57fd48d53eda426a6c6aecc36535ccf580a443","url":"https://github.com/ItsNotCam/june/commit/0e57fd48d53eda426a6c6aecc36535ccf580a443","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"9c7c50926e56f56d88fd66b5cf3418d74163be7e","url":"https://github.com/ItsNotCam/june/commit/9c7c50926e56f56d88fd66b5cf3418d74163be7e","weight":0.9}],"data":{"attributed_loc_by_commit":{"9c7c50926e56f56d88fd66b5cf3418d74163be7e":437,"0e57fd48d53eda426a6c6aecc36535ccf580a443":127,"049408f7c23c9625f92ad08966eef99bf450857d":3730,"b1975d40b0a0dc47dd79695c69b91cd0bf0355a9":7873,"ac611fc0f43b11cd4432e62142265e8d6681d525":8,"9a33f6e11e47acb58879094e995fd1cec09acbea":310,"a0a04b76b184836d90561a199f04a9bc302c8189":77,"1b444570e6077db29feea7f0de138562794261f3":1403,"9c663637adb851a3e2eb64d76be8283c6605842a":1248,"53cb8d0e9c1075c678385b5d7702f4d497b62c7d":78,"85de3b7fab7647793f5f9334a67106dfa3a0f2ab":9,"5c254d9e57f16ea052fae7dcb998833c72d8e4d8":88,"3ea7f1e63bff61043d62a339707445443cd46611":1,"52f5d8e5c50b3dd5bfdfa09b32eb20a17019c5e2":0,"21d6c2504cea6e1c9d92472d1dfafcb837b2decd":167,"cac750c3b314b5191ffc78703a067cd0685cfd4a":250,"1b12b38d6b82b94d3ecbc403f74a8d379724bccd":185,"a1be6b629e62c66d44bf86f7e48f3c4f1d13f4b3":0},"tools":{"claude-code":{"name":"Claude Code","commits":18,"loc":15991,"first_seen":1776731900,"last_seen":1781715309}},"monthly":{"2026-04":{"loc":30925,"attributed_loc":12562},"2026-06":{"loc":23060,"attributed_loc":3429}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":45.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1776391361.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":".claude/notes/.gitignore (claude-code configuration)","ref":".claude/notes/.gitignore","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/.gitignore","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/_templates/CONVENTIONS.md (claude-code configuration)","ref":".claude/notes/_templates/CONVENTIONS.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/_templates/CONVENTIONS.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/_templates/Note.md (claude-code configuration)","ref":".claude/notes/_templates/Note.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/_templates/Note.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/docs/01-architecture.md (claude-code configuration)","ref":".claude/notes/docs/01-architecture.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/docs/01-architecture.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/docs/02-ingestion-pipeline.md (claude-code configuration)","ref":".claude/notes/docs/02-ingestion-pipeline.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/docs/02-ingestion-pipeline.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/docs/03-bench-evaluation.md (claude-code configuration)","ref":".claude/notes/docs/03-bench-evaluation.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/docs/03-bench-evaluation.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/docs/04-frontend.md (claude-code configuration)","ref":".claude/notes/docs/04-frontend.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/docs/04-frontend.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/docs/05-mcp-server.md (claude-code configuration)","ref":".claude/notes/docs/05-mcp-server.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/docs/05-mcp-server.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/docs/06-shared-and-conventions.md (claude-code configuration)","ref":".claude/notes/docs/06-shared-and-conventions.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/docs/06-shared-and-conventions.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/docs/07-dev-workflow.md (claude-code configuration)","ref":".claude/notes/docs/07-dev-workflow.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/docs/07-dev-workflow.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/docs/08-planning-artifacts.md (claude-code configuration)","ref":".claude/notes/docs/08-planning-artifacts.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/docs/08-planning-artifacts.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/docs/README.md (claude-code configuration)","ref":".claude/notes/docs/README.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/docs/README.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/engineering-log/bench-multihop/double-all-tiers-160-questions.md (claude-code configuration)","ref":".claude/notes/engineering-log/bench-multihop/double-all-tiers-160-questions.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/engineering-log/bench-multihop/double-all-tiers-160-questions.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/engineering-log/bench-multihop/phase1-sequential-bridge-walk.md (claude-code configuration)","ref":".claude/notes/engineering-log/bench-multihop/phase1-sequential-bridge-walk.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/engineering-log/bench-multihop/phase1-sequential-bridge-walk.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/engineering-log/bench-multihop/phase2-reader-judge-chain-composition.md (claude-code configuration)","ref":".claude/notes/engineering-log/bench-multihop/phase2-reader-judge-chain-composition.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/engineering-log/bench-multihop/phase2-reader-judge-chain-composition.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/engineering-log/bench-multihop/phase3-t7-4hop-wiring.md (claude-code configuration)","ref":".claude/notes/engineering-log/bench-multihop/phase3-t7-4hop-wiring.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/engineering-log/bench-multihop/phase3-t7-4hop-wiring.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/engineering-log/bench-multihop/phase3b-t7-certified-self-authored.md (claude-code configuration)","ref":".claude/notes/engineering-log/bench-multihop/phase3b-t7-certified-self-authored.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/engineering-log/bench-multihop/phase3b-t7-certified-self-authored.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/engineering-log/bench-multihop/t4-fix-and-deep-hop-foundation.md (claude-code configuration)","ref":".claude/notes/engineering-log/bench-multihop/t4-fix-and-deep-hop-foundation.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/engineering-log/bench-multihop/t4-fix-and-deep-hop-foundation.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/bench-rag-quality-v1/01-diagnose-reader-vs-retrieval.md (claude-code configuration)","ref":".claude/notes/plans/bench-rag-quality-v1/01-diagnose-reader-vs-retrieval.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/bench-rag-quality-v1/01-diagnose-reader-vs-retrieval.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/bench-rag-quality-v1/02-reader-window-sweep.md (claude-code configuration)","ref":".claude/notes/plans/bench-rag-quality-v1/02-reader-window-sweep.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/bench-rag-quality-v1/02-reader-window-sweep.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/bench-rag-quality-v1/03-fairer-reranker-gauge.md (claude-code configuration)","ref":".claude/notes/plans/bench-rag-quality-v1/03-fairer-reranker-gauge.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/bench-rag-quality-v1/03-fairer-reranker-gauge.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/bench-rag-quality-v1/04-t4-retrieval-frontier.md (claude-code configuration)","ref":".claude/notes/plans/bench-rag-quality-v1/04-t4-retrieval-frontier.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/bench-rag-quality-v1/04-t4-retrieval-frontier.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/bench-rag-quality-v1/05-reader-comprehension.md (claude-code configuration)","ref":".claude/notes/plans/bench-rag-quality-v1/05-reader-comprehension.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/bench-rag-quality-v1/05-reader-comprehension.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/bench-rag-quality-v1/06-deep-multi-hop-3-4-hop.md (claude-code configuration)","ref":".claude/notes/plans/bench-rag-quality-v1/06-deep-multi-hop-3-4-hop.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/bench-rag-quality-v1/06-deep-multi-hop-3-4-hop.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/bench-rag-quality-v1/BENCH_SPEC.md (claude-code configuration)","ref":".claude/notes/plans/bench-rag-quality-v1/BENCH_SPEC.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/bench-rag-quality-v1/BENCH_SPEC.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/bench-rag-quality-v1/reranker-second-pass-handoff.md (claude-code configuration)","ref":".claude/notes/plans/bench-rag-quality-v1/reranker-second-pass-handoff.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/bench-rag-quality-v1/reranker-second-pass-handoff.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/ingestion-pipeline-benchmark-v1/HANDOFF_BENCH_SPEC.md (claude-code configuration)","ref":".claude/notes/plans/ingestion-pipeline-benchmark-v1/HANDOFF_BENCH_SPEC.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/ingestion-pipeline-benchmark-v1/HANDOFF_BENCH_SPEC.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/ingestion-pipeline-v1/AUDIT_FINDINGS.md (claude-code configuration)","ref":".claude/notes/plans/ingestion-pipeline-v1/AUDIT_FINDINGS.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/ingestion-pipeline-v1/AUDIT_FINDINGS.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/ingestion-pipeline-v1/AUDIT_REPORT.md (claude-code configuration)","ref":".claude/notes/plans/ingestion-pipeline-v1/AUDIT_REPORT.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/ingestion-pipeline-v1/AUDIT_REPORT.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/ingestion-pipeline-v1/CONSTRAINTS.md (claude-code configuration)","ref":".claude/notes/plans/ingestion-pipeline-v1/CONSTRAINTS.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/ingestion-pipeline-v1/CONSTRAINTS.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/ingestion-pipeline-v1/CONTINUATION_PLAN.md (claude-code configuration)","ref":".claude/notes/plans/ingestion-pipeline-v1/CONTINUATION_PLAN.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/ingestion-pipeline-v1/CONTINUATION_PLAN.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/ingestion-pipeline-v1/HANDOFF_CHAT3.md (claude-code configuration)","ref":".claude/notes/plans/ingestion-pipeline-v1/HANDOFF_CHAT3.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/ingestion-pipeline-v1/HANDOFF_CHAT3.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/ingestion-pipeline-v1/INGESTION_PIPELINE_SPEC.md (claude-code configuration)","ref":".claude/notes/plans/ingestion-pipeline-v1/INGESTION_PIPELINE_SPEC.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/ingestion-pipeline-v1/INGESTION_PIPELINE_SPEC.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/ingestion-pipeline-v1/RESEARCH_BRIEF.md (claude-code configuration)","ref":".claude/notes/plans/ingestion-pipeline-v1/RESEARCH_BRIEF.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/ingestion-pipeline-v1/RESEARCH_BRIEF.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/ingestion-pipeline-v1/SKELETON.md (claude-code configuration)","ref":".claude/notes/plans/ingestion-pipeline-v1/SKELETON.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/ingestion-pipeline-v1/SKELETON.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/ingestion-pipeline-v1/TEST_BRIEF.md (claude-code configuration)","ref":".claude/notes/plans/ingestion-pipeline-v1/TEST_BRIEF.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/ingestion-pipeline-v1/TEST_BRIEF.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/rsi-bench-foundation/bench-audit-findings.md (claude-code configuration)","ref":".claude/notes/plans/rsi-bench-foundation/bench-audit-findings.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/rsi-bench-foundation/bench-audit-findings.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/rsi-bench-foundation/rsi-foundation-plan.md (claude-code configuration)","ref":".claude/notes/plans/rsi-bench-foundation/rsi-foundation-plan.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/rsi-bench-foundation/rsi-foundation-plan.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/rsi-bench-foundation/rsi-foundation-status.md (claude-code configuration)","ref":".claude/notes/plans/rsi-bench-foundation/rsi-foundation-status.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/rsi-bench-foundation/rsi-foundation-status.md","weight":0.5},{"kind":"ai-artifact","description":".claude/notes/plans/rsi-bench-foundation/rsi-research-dossier.md (claude-code configuration)","ref":".claude/notes/plans/rsi-bench-foundation/rsi-research-dossier.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/notes/plans/rsi-bench-foundation/rsi-research-dossier.md","weight":0.5},{"kind":"ai-artifact","description":".claude/skills/engineering-log/SKILL.md (claude-code configuration)","ref":".claude/skills/engineering-log/SKILL.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/skills/engineering-log/SKILL.md","weight":0.5},{"kind":"ai-artifact","description":".claude/synopsis.md (claude-code configuration)","ref":".claude/synopsis.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/.claude/synopsis.md","weight":0.5},{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"packages/mcp/bench/CLAUDE.md (claude-code configuration)","ref":"packages/mcp/bench/CLAUDE.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"packages/mcp/bench/src/dashboard/CLAUDE.md (claude-code configuration)","ref":"packages/mcp/bench/src/dashboard/CLAUDE.md","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/src/dashboard/CLAUDE.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":".claude/notes/.gitignore","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/_templates/CONVENTIONS.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/_templates/Note.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/docs/01-architecture.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/docs/02-ingestion-pipeline.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/docs/03-bench-evaluation.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/docs/04-frontend.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/docs/05-mcp-server.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/docs/06-shared-and-conventions.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/docs/07-dev-workflow.md","added_at":1781717302},{"tool":"claude-code","path":".claude/notes/docs/08-planning-artifacts.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/docs/README.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/engineering-log/bench-multihop/double-all-tiers-160-questions.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/engineering-log/bench-multihop/phase1-sequential-bridge-walk.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/engineering-log/bench-multihop/phase2-reader-judge-chain-composition.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/engineering-log/bench-multihop/phase3-t7-4hop-wiring.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/engineering-log/bench-multihop/phase3b-t7-certified-self-authored.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/engineering-log/bench-multihop/t4-fix-and-deep-hop-foundation.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/plans/bench-rag-quality-v1/01-diagnose-reader-vs-retrieval.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/plans/bench-rag-quality-v1/02-reader-window-sweep.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/plans/bench-rag-quality-v1/03-fairer-reranker-gauge.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/plans/bench-rag-quality-v1/04-t4-retrieval-frontier.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/plans/bench-rag-quality-v1/05-reader-comprehension.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/plans/bench-rag-quality-v1/06-deep-multi-hop-3-4-hop.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/plans/bench-rag-quality-v1/BENCH_SPEC.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/plans/bench-rag-quality-v1/reranker-second-pass-handoff.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/plans/ingestion-pipeline-benchmark-v1/HANDOFF_BENCH_SPEC.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/plans/ingestion-pipeline-v1/AUDIT_FINDINGS.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/plans/ingestion-pipeline-v1/AUDIT_REPORT.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/plans/ingestion-pipeline-v1/CONSTRAINTS.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/plans/ingestion-pipeline-v1/CONTINUATION_PLAN.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/plans/ingestion-pipeline-v1/HANDOFF_CHAT3.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/plans/ingestion-pipeline-v1/INGESTION_PIPELINE_SPEC.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/plans/ingestion-pipeline-v1/RESEARCH_BRIEF.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/plans/ingestion-pipeline-v1/SKELETON.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/plans/ingestion-pipeline-v1/TEST_BRIEF.md","added_at":1781715309},{"tool":"claude-code","path":".claude/notes/plans/rsi-bench-foundation/bench-audit-findings.md","added_at":1781720339},{"tool":"claude-code","path":".claude/notes/plans/rsi-bench-foundation/rsi-foundation-plan.md","added_at":1781720339},{"tool":"claude-code","path":".claude/notes/plans/rsi-bench-foundation/rsi-foundation-status.md","added_at":1781720339},{"tool":"claude-code","path":".claude/notes/plans/rsi-bench-foundation/rsi-research-dossier.md","added_at":1781720339},{"tool":"claude-code","path":".claude/skills/engineering-log/SKILL.md","added_at":1781715309},{"tool":"claude-code","path":".claude/synopsis.md","added_at":1776391361},{"tool":"claude-code","path":"CLAUDE.md","added_at":1781574418},{"tool":"claude-code","path":"packages/mcp/bench/CLAUDE.md","added_at":1781409365},{"tool":"claude-code","path":"packages/mcp/bench/src/dashboard/CLAUDE.md","added_at":1781924177}],"workflows":[],"tools":["claude-code"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":36.0,"flagged_units":7.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":46112.0,"flagged_loc":33320.0,"flagged_loc_share":0.722588480222068,"max_loc_per_hour":4238.636363636364,"median_loc_per_hour":213.58129580676697,"pr_timed_units":0.0,"excluded_import_loc":7873.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"3,730 lines of first-party code in ~0.9h (4,239 lines/hour, 1 commit session)","ref":"049408f7c23c9625f92ad08966eef99bf450857d","url":"https://github.com/ItsNotCam/june/commit/049408f7c23c9625f92ad08966eef99bf450857d","weight":0.6},{"kind":"velocity-burst","description":"12,440 lines of first-party code in ~4.0h (3,102 lines/hour, 8 commit session)","ref":"973e218bedbec1f1d733fcda3711fe614a2b1f33","url":"https://github.com/ItsNotCam/june/commit/973e218bedbec1f1d733fcda3711fe614a2b1f33","weight":0.6},{"kind":"velocity-burst","description":"5,878 lines of first-party code in ~2.7h (2,156 lines/hour, 6 commit session)","ref":"08446770e1f0b157c05f869dc2837c696b923b43","url":"https://github.com/ItsNotCam/june/commit/08446770e1f0b157c05f869dc2837c696b923b43","weight":0.6},{"kind":"velocity-burst","description":"3,937 lines of first-party code in ~2.1h (1,876 lines/hour, 2 commit session)","ref":"97161f0c29132729bd7879fbf24839f3438002fe","url":"https://github.com/ItsNotCam/june/commit/97161f0c29132729bd7879fbf24839f3438002fe","weight":0.5627263102170461},{"kind":"velocity-burst","description":"2,551 lines of first-party code in ~1.7h (1,512 lines/hour, 3 commit session)","ref":"88b62dc624f3f80f155df58f976f7f141dfd14f0","url":"https://github.com/ItsNotCam/june/commit/88b62dc624f3f80f155df58f976f7f141dfd14f0","weight":0.4537351778656126},{"kind":"velocity-burst","description":"3,650 lines of first-party code in ~4.8h (753 lines/hour, 8 commit session)","ref":"3ea7f1e63bff61043d62a339707445443cd46611","url":"https://github.com/ItsNotCam/june/commit/3ea7f1e63bff61043d62a339707445443cd46611","weight":0.22596732588134133},{"kind":"velocity-burst","description":"1,134 lines of first-party code in ~1.9h (592 lines/hour, 3 commit session)","ref":"55a41fd07d804839bc087e195779cd4824f5b0c1","url":"https://github.com/ItsNotCam/june/commit/55a41fd07d804839bc087e195779cd4824f5b0c1","weight":0.17762436548223348}],"data":{"flagged_loc_by_commit":{"e8eeddcad85b31db0418d61667c8f37d11f2c26d":158,"284c9de3c04f9eae245b90b5ffdd1d2c48d0e944":82,"55a41fd07d804839bc087e195779cd4824f5b0c1":894,"c4350602e328e14c3f635ad84e888d6a8f80443f":196,"5b225a5f5764fc3b69d8412a8314bd7202460d76":1839,"6041b346c9eec1fcb63c0fd687277663b476182c":469,"053f827d533b8ac04692c03af00f564d7dbf7ecc":413,"d5488cd2699c81782aefc1fa5b5f67f5911cedd7":2491,"cfe63f3a336bc4c790380d44320d93f4c027f82b":3904,"f3e1fdb86a1d0927e8e7ba13e48be0874618e457":2839,"973e218bedbec1f1d733fcda3711fe614a2b1f33":289,"049408f7c23c9625f92ad08966eef99bf450857d":3730,"1b444570e6077db29feea7f0de138562794261f3":1403,"9c663637adb851a3e2eb64d76be8283c6605842a":1248,"53cb8d0e9c1075c678385b5d7702f4d497b62c7d":78,"e48443ed294a9c4254171ee1d6eed1ee57177b4d":819,"85de3b7fab7647793f5f9334a67106dfa3a0f2ab":9,"5c254d9e57f16ea052fae7dcb998833c72d8e4d8":88,"9cc85201d4e95d401b338a25cc8628081db9505a":4,"3ea7f1e63bff61043d62a339707445443cd46611":1,"1dd72b1d4ce99fb431fe65ea45bba8276f40284d":3578,"97161f0c29132729bd7879fbf24839f3438002fe":359,"867d93bf9696c9abcb9fe420f30b3b2059e9da17":1091,"00b8d76b45b3a3903883d35a7608b549b36d2fd3":885,"88b62dc624f3f80f155df58f976f7f141dfd14f0":575,"9291411585cc2b46208e934cddd5acad2f92d7bc":2430,"ff6058ba1df0a371b0f841cc56f188dbfd2c7bfc":979,"5baa8f053f977a61ef02e7d5f5ebddaaf6f0fd09":224,"3173e447d524277518b7248e549124646a2d6e08":259,"fccfed9f0b16da9f8dc36c33333aac46e9c74ec3":1514,"08446770e1f0b157c05f869dc2837c696b923b43":472},"excluded_import_commits":["b1975d40b0a0dc47dd79695c69b91cd0bf0355a9"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":32015.0,"index":0.328,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":21.0,"per_kloc:emoji_in_code":0.656,"files:emoji_in_code":8.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":341.0,"findings_high":19.0,"findings_medium":322.0,"findings_low":0.0,"weighted_findings":95.1,"scanned_lines":31868.0,"parse_errors":5.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.detect-child-process","severity":"high","message":"Detected calls to child_process from a function argument `juneBin`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low]","path":"packages/mcp/bench/cli/health.ts","line":112,"fingerprint":"javascript.lang.security.detect-child-process:packages/mcp/bench/cli/health.ts:112"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":146,"fingerprint":"javascript.browser.security.insecure-document-method:packages/mcp/bench/src/dashboard/public/app.js:146"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `box.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":146,"fingerprint":"javascript.browser.security.insecure-innerhtml:packages/mcp/bench/src/dashboard/public/app.js:146"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":157,"fingerprint":"javascript.browser.security.insecure-document-method:packages/mcp/bench/src/dashboard/public/app.js:157"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `chip.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":157,"fingerprint":"javascript.browser.security.insecure-innerhtml:packages/mcp/bench/src/dashboard/public/app.js:157"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":289,"fingerprint":"javascript.browser.security.insecure-document-method:packages/mcp/bench/src/dashboard/public/app.js:289"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `meta.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":289,"fingerprint":"javascript.browser.security.insecure-innerhtml:packages/mcp/bench/src/dashboard/public/app.js:289"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":332,"fingerprint":"javascript.browser.security.insecure-document-method:packages/mcp/bench/src/dashboard/public/app.js:332"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `body.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":332,"fingerprint":"javascript.browser.security.insecure-innerhtml:packages/mcp/bench/src/dashboard/public/app.js:332"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":352,"fingerprint":"javascript.browser.security.insecure-document-method:packages/mcp/bench/src/dashboard/public/app.js:352"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `tr.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":352,"fingerprint":"javascript.browser.security.insecure-innerhtml:packages/mcp/bench/src/dashboard/public/app.js:352"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":403,"fingerprint":"javascript.browser.security.insecure-document-method:packages/mcp/bench/src/dashboard/public/app.js:403"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `$(\"detail-body\").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":403,"fingerprint":"javascript.browser.security.insecure-innerhtml:packages/mcp/bench/src/dashboard/public/app.js:403"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":406,"fingerprint":"javascript.browser.security.insecure-document-method:packages/mcp/bench/src/dashboard/public/app.js:406"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `$(\"detail-body\").innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":406,"fingerprint":"javascript.browser.security.insecure-innerhtml:packages/mcp/bench/src/dashboard/public/app.js:406"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":568,"fingerprint":"javascript.browser.security.insecure-document-method:packages/mcp/bench/src/dashboard/public/app.js:568"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `view.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":568,"fingerprint":"javascript.browser.security.insecure-innerhtml:packages/mcp/bench/src/dashboard/public/app.js:568"},{"rule_id":"opengrep/javascript.browser.security.insecure-document-method","severity":"high","message":"User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":653,"fingerprint":"javascript.browser.security.insecure-document-method:packages/mcp/bench/src/dashboard/public/app.js:653"},{"rule_id":"opengrep/javascript.browser.security.insecure-innerhtml","severity":"high","message":"User controlled data in a `wrap.innerHTML` is an anti-pattern that can lead to XSS vulnerabilities [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":653,"fingerprint":"javascript.browser.security.insecure-innerhtml:packages/mcp/bench/src/dashboard/public/app.js:653"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":47,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/cli/author.ts:47"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":49,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/author.ts:49"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":54,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/cli/author.ts:54"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":57,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/author.ts:57"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":58,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/author.ts:58"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":63,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/author.ts:63"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":91,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/author.ts:91"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":96,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/author.ts:96"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":108,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/author.ts:108"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":109,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/author.ts:109"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":114,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/author.ts:114"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":114,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/author.ts:114"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":118,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/author.ts:118"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":121,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/author.ts:121"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":124,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/author.ts:124"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":138,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/author.ts:138"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":139,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/author.ts:139"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `f` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":139,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/author.ts:139"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":139,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/author.ts:139"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":139,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/author.ts:139"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":140,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/author.ts:140"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":141,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/author.ts:141"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":142,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/author.ts:142"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/cli/author.ts","line":152,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/cli/author.ts:152"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/compare.ts","line":31,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/compare.ts:31"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/compare.ts","line":32,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/compare.ts:32"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/compare.ts","line":33,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/compare.ts:33"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/compare.ts","line":45,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/compare.ts:45"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/compare.ts","line":46,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/compare.ts:46"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/control.ts","line":218,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/control.ts:218"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/control.ts","line":244,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/control.ts:244"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/control.ts","line":247,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/control.ts:247"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/control.ts","line":327,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/control.ts:327"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/control.ts","line":373,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/control.ts:373"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/control.ts","line":375,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/control.ts:375"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/control.ts","line":427,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/control.ts:427"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/control.ts","line":429,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/control.ts:429"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/dashboard.ts","line":44,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/dashboard.ts:44"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/dashboard.ts","line":45,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/dashboard.ts:45"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":45,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/freeze.ts:45"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":49,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/cli/freeze.ts:49"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":54,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/freeze.ts:54"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":55,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/freeze.ts:55"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":55,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/freeze.ts:55"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":58,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/freeze.ts:58"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":82,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/freeze.ts:82"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":82,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/freeze.ts:82"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":85,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/freeze.ts:85"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":85,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/freeze.ts:85"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":87,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/freeze.ts:87"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":89,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/freeze.ts:89"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":89,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/freeze.ts:89"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":94,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/freeze.ts:94"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":96,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/freeze.ts:96"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":96,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/freeze.ts:96"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":98,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/freeze.ts:98"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":108,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/freeze.ts:108"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":135,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/freeze.ts:135"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/freeze.ts","line":136,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/freeze.ts:136"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/generate.ts","line":70,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/generate.ts:70"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/generate.ts","line":71,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/generate.ts:71"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/generate.ts","line":71,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/generate.ts:71"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/generate.ts","line":72,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/generate.ts:72"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/generate.ts","line":73,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/generate.ts:73"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/generate.ts","line":74,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/generate.ts:74"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/generate.ts","line":75,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/generate.ts:75"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/generate.ts","line":76,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/generate.ts:76"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":95,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:95"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":96,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:96"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":106,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/holdout.ts:106"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":114,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:114"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":115,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/holdout.ts:115"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":117,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/holdout.ts:117"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `d` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":117,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/holdout.ts:117"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":117,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:117"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":117,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:117"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":126,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:126"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":128,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:128"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":154,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:154"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":157,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:157"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":163,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:163"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":168,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:168"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":176,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/holdout.ts:176"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":177,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/holdout.ts:177"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `f` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":177,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/holdout.ts:177"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":177,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:177"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":177,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:177"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":178,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:178"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":179,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:179"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":190,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/cli/holdout.ts:190"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":206,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:206"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":209,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/cli/holdout.ts:209"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":212,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:212"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":213,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:213"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":213,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:213"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":216,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:216"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":229,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/holdout.ts:229"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":229,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:229"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":231,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:231"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":231,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:231"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":233,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:233"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":235,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:235"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":235,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:235"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":238,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:238"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":240,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:240"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":240,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:240"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":242,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:242"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":252,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:252"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":272,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:272"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":273,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:273"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":300,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:300"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":301,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:301"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":312,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:312"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":314,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:314"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":325,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:325"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":325,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:325"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":326,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/holdout.ts:326"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":331,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:331"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":336,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:336"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":340,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:340"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":364,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:364"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":417,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:417"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":418,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:418"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":473,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:473"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":515,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:515"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":516,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:516"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":518,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/holdout.ts:518"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":533,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/cli/holdout.ts:533"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":551,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:551"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":555,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:555"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":556,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:556"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":562,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:562"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":583,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/holdout.ts:583"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":604,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:604"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `splitDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":607,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/holdout.ts:607"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":607,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:607"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":607,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:607"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":616,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:616"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/holdout.ts","line":617,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/holdout.ts:617"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/measure.ts","line":109,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/measure.ts:109"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/measure.ts","line":137,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/measure.ts:137"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/measure.ts","line":241,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/measure.ts:241"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/measure.ts","line":248,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/measure.ts:248"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/measure.ts","line":296,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/measure.ts:296"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/report.ts","line":28,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/report.ts:28"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/report.ts","line":29,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/report.ts:29"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/report.ts","line":30,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/report.ts:30"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/report.ts","line":32,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/report.ts:32"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":87,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/cli/run.ts:87"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":91,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:91"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":92,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:92"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":185,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:185"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":187,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:187"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":190,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:190"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":289,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:289"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":289,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:289"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":290,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/run.ts:290"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":294,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:294"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":298,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:298"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":302,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:302"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":345,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:345"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":346,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:346"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":347,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:347"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":349,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:349"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":351,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:351"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":352,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:352"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":353,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:353"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":354,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:354"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":395,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:395"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":469,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:469"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":583,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:583"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":668,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/cli/run.ts:668"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":912,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/cli/run.ts:912"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":995,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:995"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":1011,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:1011"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":1066,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:1066"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":1066,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:1066"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":1169,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:1169"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":1169,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:1169"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":1199,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:1199"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":1199,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:1199"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":1200,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:1200"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/run.ts","line":1200,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/run.ts:1200"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/score.ts","line":37,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/score.ts:37"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/score.ts","line":43,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/score.ts:43"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/score.ts","line":44,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/score.ts:44"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/score.ts","line":48,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/score.ts:48"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `argv` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/cli/score.ts","line":89,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/cli/score.ts:89"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/validate-judge.ts","line":46,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/validate-judge.ts:46"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/validate-judge.ts","line":69,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/validate-judge.ts:69"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/validate-judge.ts","line":96,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/validate-judge.ts:96"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/validate-judge.ts","line":98,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/validate-judge.ts:98"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/cli/validate-judge.ts","line":119,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/cli/validate-judge.ts:119"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `p` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/scripts/judge-screen.ts","line":38,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/scripts/judge-screen.ts:38"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `corpusDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/scripts/triage-failures.ts","line":62,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/scripts/triage-failures.ts:62"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `corpusDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/scripts/triage-failures.ts","line":64,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/scripts/triage-failures.ts:64"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/scripts/triage-failures.ts","line":64,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/scripts/triage-failures.ts:64"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/scripts/triage-failures.ts","line":64,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/scripts/triage-failures.ts:64"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `logPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/scripts/triage-multihop.ts","line":118,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/scripts/triage-multihop.ts:118"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":22,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:22"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":23,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:23"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":32,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:32"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":33,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:33"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":157,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:157"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":301,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:301"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":311,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:311"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":319,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:319"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":329,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:329"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":352,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:352"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":379,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:379"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":386,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:386"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":388,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:388"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":406,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:406"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":482,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:482"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":490,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:490"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":515,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:515"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":547,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:547"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":569,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:569"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":639,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:639"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"packages/mcp/bench/src/dashboard/public/app.js","line":653,"fingerprint":"javascript.lang.security.html-in-template-string:packages/mcp/bench/src/dashboard/public/app.js:653"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":101,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/src/dashboard/reader.ts:101"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":190,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:190"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":190,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:190"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":191,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:191"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":192,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:192"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":206,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:206"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `runsRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":229,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/src/dashboard/reader.ts:229"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":253,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:253"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":253,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:253"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":254,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:254"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":255,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:255"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `runId` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":260,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/src/dashboard/reader.ts:260"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `runsRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":260,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/src/dashboard/reader.ts:260"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":260,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:260"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `runId` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":266,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/src/dashboard/reader.ts:266"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `runsRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":266,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/src/dashboard/reader.ts:266"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":266,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:266"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":347,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:347"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":347,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:347"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":348,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:348"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":349,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:349"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":351,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:351"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":356,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:356"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `runsRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":358,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/src/dashboard/reader.ts:358"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `runsRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":365,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/src/dashboard/reader.ts:365"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":372,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:372"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `runDir` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":382,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/src/dashboard/reader.ts:382"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":382,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:382"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":421,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:421"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":421,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:421"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `runId` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":424,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/src/dashboard/reader.ts:424"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `runsRoot` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":424,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/src/dashboard/reader.ts:424"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":462,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:462"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/reader.ts","line":464,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/reader.ts:464"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/server.ts","line":71,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/server.ts:71"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/server.ts","line":110,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/server.ts:110"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/server.ts","line":110,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/server.ts:110"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/server.ts","line":111,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/server.ts:111"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/dashboard/server.ts","line":111,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/dashboard/server.ts:111"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/src/lib/artifacts.ts","line":19,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/src/lib/artifacts.ts:19"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/src/lib/artifacts.ts","line":22,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/src/lib/artifacts.ts:22"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/src/lib/artifacts.ts","line":23,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/src/lib/artifacts.ts:23"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/src/lib/artifacts.ts","line":23,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/src/lib/artifacts.ts:23"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/src/lib/artifacts.ts","line":34,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/src/lib/artifacts.ts:34"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/src/lib/artifacts.ts","line":41,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/src/lib/artifacts.ts:41"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `path` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/src/lib/artifacts.ts","line":56,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/src/lib/artifacts.ts:56"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename","severity":"medium","message":"Detected that function argument `current` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are validated. [confidence low]","path":"packages/mcp/bench/src/lib/artifacts.ts","line":70,"fingerprint":"javascript.lang.security.audit.detect-non-literal-fs-filename:packages/mcp/bench/src/lib/artifacts.ts:70"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/lib/artifacts.ts","line":72,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/lib/artifacts.ts:72"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/lib/artifacts.ts","line":72,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/lib/artifacts.ts:72"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/lib/fixture-lock.ts","line":99,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/lib/fixture-lock.ts:99"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/lib/fixture-lock.ts","line":100,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/lib/fixture-lock.ts:100"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/lib/fixture-lock.ts","line":101,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/lib/fixture-lock.ts:101"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/lib/fixture-lock.ts","line":116,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/lib/fixture-lock.ts:116"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/lib/fixture-lock.ts","line":121,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/lib/fixture-lock.ts:121"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/lib/fixture-lock.ts","line":121,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/lib/fixture-lock.ts:121"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/lib/fixture-lock.ts","line":207,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/lib/fixture-lock.ts:207"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/lib/fixture-lock.ts","line":243,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/lib/fixture-lock.ts:243"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/lib/holdout-lock.ts","line":73,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/lib/holdout-lock.ts:73"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/lib/holdout-lock.ts","line":74,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/lib/holdout-lock.ts:74"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/lib/holdout-lock.ts","line":84,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/lib/holdout-lock.ts:84"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"packages/mcp/bench/src/lib/holdout-lock.ts","line":89,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:packages/mcp/bench/src/lib/holdout-lock.ts:89"}],"evidence":[],"data":{"rulesets":["typescript","javascript","bash","python","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":30.0,"vulnerabilities":165.0,"vulns_critical":6.0,"vulns_high":67.0,"vulns_medium":80.0,"vulns_low":12.0,"vulns_unknown":0.0,"penalty":207.0},"findings":[{"rule_id":"osv/GHSA-2464-fhr4-w9xw","severity":"critical","message":"next@16.2.4 (npm) is affected by GHSA-2464-fhr4-w9xw; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-2464-fhr4-w9xw"},{"rule_id":"osv/GHSA-2xp9-vwfh-vxw4","severity":"critical","message":"next@16.2.4 (npm) is affected by GHSA-2xp9-vwfh-vxw4; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-2xp9-vwfh-vxw4"},{"rule_id":"osv/GHSA-673q-mjm6-r5xr","severity":"critical","message":"next@16.2.4 (npm) is affected by GHSA-673q-mjm6-r5xr; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-673q-mjm6-r5xr"},{"rule_id":"osv/GHSA-p293-qw3h-jr36","severity":"critical","message":"next@16.2.4 (npm) is affected by GHSA-p293-qw3h-jr36; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-p293-qw3h-jr36"},{"rule_id":"osv/GHSA-vcvr-r3jv-pc5j","severity":"critical","message":"next@16.2.4 (npm) is affected by GHSA-vcvr-r3jv-pc5j; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-vcvr-r3jv-pc5j"},{"rule_id":"osv/GHSA-jqcg-44mw-7w3h","severity":"critical","message":"proxy-addr@2.0.7 (npm) is affected by GHSA-jqcg-44mw-7w3h; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"proxy-addr@2.0.7 (npm):GHSA-jqcg-44mw-7w3h"},{"rule_id":"osv/GHSA-22jm-h49p-29qw","severity":"high","message":"@modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-22jm-h49p-29qw; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.29.0 (npm):GHSA-22jm-h49p-29qw"},{"rule_id":"osv/GHSA-46jr-4wx8-v453","severity":"high","message":"@modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-46jr-4wx8-v453; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.29.0 (npm):GHSA-46jr-4wx8-v453"},{"rule_id":"osv/GHSA-6qxp-vccf-f47h","severity":"high","message":"@modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-6qxp-vccf-f47h; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.29.0 (npm):GHSA-6qxp-vccf-f47h"},{"rule_id":"osv/GHSA-f897-62hf-6gxq","severity":"high","message":"@modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-f897-62hf-6gxq; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.29.0 (npm):GHSA-f897-62hf-6gxq"},{"rule_id":"osv/GHSA-7q85-xj36-vmfc","severity":"high","message":"adm-zip@0.5.17 (npm) is affected by GHSA-7q85-xj36-vmfc","path":"bun.lock","line":null,"fingerprint":"adm-zip@0.5.17 (npm):GHSA-7q85-xj36-vmfc"},{"rule_id":"osv/GHSA-8238-w5pm-2374","severity":"high","message":"adm-zip@0.5.17 (npm) is affected by GHSA-8238-w5pm-2374","path":"bun.lock","line":null,"fingerprint":"adm-zip@0.5.17 (npm):GHSA-8238-w5pm-2374"},{"rule_id":"osv/GHSA-j5f4-cc29-5x44","severity":"high","message":"adm-zip@0.5.17 (npm) is affected by GHSA-j5f4-cc29-5x44","path":"bun.lock","line":null,"fingerprint":"adm-zip@0.5.17 (npm):GHSA-j5f4-cc29-5x44"},{"rule_id":"osv/GHSA-rcw4-f5rp-g42v","severity":"high","message":"adm-zip@0.5.17 (npm) is affected by GHSA-rcw4-f5rp-g42v","path":"bun.lock","line":null,"fingerprint":"adm-zip@0.5.17 (npm):GHSA-rcw4-f5rp-g42v"},{"rule_id":"osv/GHSA-xcpc-8h2w-3j85","severity":"high","message":"adm-zip@0.5.17 (npm) is affected by GHSA-xcpc-8h2w-3j85","path":"bun.lock","line":null,"fingerprint":"adm-zip@0.5.17 (npm):GHSA-xcpc-8h2w-3j85"},{"rule_id":"osv/GHSA-27r3-jxmh-p828","severity":"high","message":"body-parser@2.2.2 (npm) is affected by GHSA-27r3-jxmh-p828; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"body-parser@2.2.2 (npm):GHSA-27r3-jxmh-p828"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@1.1.14 (npm) is affected by GHSA-3jxr-9vmj-r5cp; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"brace-expansion@1.1.14 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.14 (npm) is affected by GHSA-6j4f-fj2g-mc7p; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"brace-expansion@1.1.14 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@1.1.14 (npm) is affected by GHSA-mh99-v99m-4gvg; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"brace-expansion@1.1.14 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.14 (npm) is affected by GHSA-qhr7-859c-m2p7; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"brace-expansion@1.1.14 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@1.1.14 (npm) is affected by GHSA-rgw5-rvv9-x895; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"brace-expansion@1.1.14 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-3jxr-9vmj-r5cp; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-6j4f-fj2g-mc7p; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-mh99-v99m-4gvg; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-qhr7-859c-m2p7; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-rgw5-rvv9-x895; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-73wf-gq98-2v4g","severity":"high","message":"browserslist@4.28.2 (npm) is affected by GHSA-73wf-gq98-2v4g; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"browserslist@4.28.2 (npm):GHSA-73wf-gq98-2v4g"},{"rule_id":"osv/GHSA-c83g-rgw3-j3cx","severity":"high","message":"browserslist@4.28.2 (npm) is affected by GHSA-c83g-rgw3-j3cx; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"browserslist@4.28.2 (npm):GHSA-c83g-rgw3-j3cx"},{"rule_id":"osv/GHSA-4c8g-83qw-93j6","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-4c8g-83qw-93j6; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-4c8g-83qw-93j6"},{"rule_id":"osv/GHSA-7p8r-x3mc-p8w7","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-7p8r-x3mc-p8w7; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-7p8r-x3mc-p8w7"},{"rule_id":"osv/GHSA-f65p-4m7j-42xc","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-f65p-4m7j-42xc; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-f65p-4m7j-42xc"},{"rule_id":"osv/GHSA-jqff-g426-hqxp","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-jqff-g426-hqxp; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-jqff-g426-hqxp"},{"rule_id":"osv/GHSA-q3j6-qgpj-74h6","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-q3j6-qgpj-74h6; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-q3j6-qgpj-74h6"},{"rule_id":"osv/GHSA-qw65-cvwx-89v3","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-qw65-cvwx-89v3; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-qw65-cvwx-89v3"},{"rule_id":"osv/GHSA-v2hh-gcrm-f6hx","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-v2hh-gcrm-f6hx; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-v2hh-gcrm-f6hx"},{"rule_id":"osv/GHSA-v39h-62p7-jpjc","severity":"high","message":"fast-uri@3.1.0 (npm) is affected by GHSA-v39h-62p7-jpjc; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-v39h-62p7-jpjc"},{"rule_id":"osv/GHSA-hmw2-7cc7-3qxx","severity":"high","message":"form-data@4.0.5 (npm) is affected by GHSA-hmw2-7cc7-3qxx","path":"bun.lock","line":null,"fingerprint":"form-data@4.0.5 (npm):GHSA-hmw2-7cc7-3qxx"},{"rule_id":"osv/GHSA-88fw-hqm2-52qc","severity":"high","message":"hono@4.12.14 (npm) is affected by GHSA-88fw-hqm2-52qc; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-88fw-hqm2-52qc"},{"rule_id":"osv/GHSA-mwp4-54f8-5fhr","severity":"high","message":"ip-address@10.1.0 (npm) is affected by GHSA-mwp4-54f8-5fhr; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-mwp4-54f8-5fhr"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-2883-xcg3-v3hh; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-52cp-r559-cp3m","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-52cp-r559-cp3m; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-52cp-r559-cp3m"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@4.1.1 (npm) is affected by GHSA-5p4m-2wfm-xmqj; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-28wg-ghj8-5hjv; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-2v37-7h3g-55p8; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-xwg4-73v4-xw9w","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-xwg4-73v4-xw9w; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-xwg4-73v4-xw9w"},{"rule_id":"osv/GHSA-267c-6grr-h53f","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-267c-6grr-h53f; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-267c-6grr-h53f"},{"rule_id":"osv/GHSA-26hh-7cqf-hhc6","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-26hh-7cqf-hhc6; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-26hh-7cqf-hhc6"},{"rule_id":"osv/GHSA-36qx-fr4f-26g5","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-36qx-fr4f-26g5; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-36qx-fr4f-26g5"},{"rule_id":"osv/GHSA-492v-c6pp-mqqv","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-492v-c6pp-mqqv; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-492v-c6pp-mqqv"},{"rule_id":"osv/GHSA-6gpp-xcg3-4w24","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-6gpp-xcg3-4w24; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-6gpp-xcg3-4w24"},{"rule_id":"osv/GHSA-89xv-2m56-2m9x","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-89xv-2m56-2m9x; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-89xv-2m56-2m9x"},{"rule_id":"osv/GHSA-8h8q-6873-q5fj","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-8h8q-6873-q5fj; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-8h8q-6873-q5fj"},{"rule_id":"osv/GHSA-c4j6-fc7j-m34r","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-c4j6-fc7j-m34r; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-c4j6-fc7j-m34r"},{"rule_id":"osv/GHSA-cjq9-62q9-8jv4","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-cjq9-62q9-8jv4; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-cjq9-62q9-8jv4"},{"rule_id":"osv/GHSA-m99w-x7hq-7vfj","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-m99w-x7hq-7vfj; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-m99w-x7hq-7vfj"},{"rule_id":"osv/GHSA-mg66-mrh9-m8jx","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-mg66-mrh9-m8jx; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-mg66-mrh9-m8jx"},{"rule_id":"osv/GHSA-p3m5-59mp-jv5r","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-p3m5-59mp-jv5r; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-p3m5-59mp-jv5r"},{"rule_id":"osv/GHSA-p9j2-gv94-2wf4","severity":"high","message":"next@16.2.4 (npm) is affected by GHSA-p9j2-gv94-2wf4; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-p9j2-gv94-2wf4"},{"rule_id":"osv/GHSA-6g55-p6wh-862q","severity":"high","message":"postcss@8.4.31 (npm) is affected by GHSA-6g55-p6wh-862q; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-6g55-p6wh-862q"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.4.31 (npm) is affected by GHSA-r28c-9q8g-f849; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-6g55-p6wh-862q","severity":"high","message":"postcss@8.5.10 (npm) is affected by GHSA-6g55-p6wh-862q; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"postcss@8.5.10 (npm):GHSA-6g55-p6wh-862q"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.5.10 (npm) is affected by GHSA-r28c-9q8g-f849; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"postcss@8.5.10 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-f88m-g3jw-g9cj","severity":"high","message":"sharp@0.34.5 (npm) is affected by GHSA-f88m-g3jw-g9cj; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"sharp@0.34.5 (npm):GHSA-f88m-g3jw-g9cj"},{"rule_id":"osv/GHSA-rgj7-g3m4-5g8c","severity":"high","message":"sharp@0.34.5 (npm) is affected by GHSA-rgj7-g3m4-5g8c; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"sharp@0.34.5 (npm):GHSA-rgj7-g3m4-5g8c"},{"rule_id":"osv/GHSA-wq5f-xc86-pv6w","severity":"high","message":"sharp@0.34.5 (npm) is affected by GHSA-wq5f-xc86-pv6w; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"sharp@0.34.5 (npm):GHSA-wq5f-xc86-pv6w"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@6.25.0 (npm) is affected by GHSA-2m5v-pch6-74hx","path":"bun.lock","line":null,"fingerprint":"undici@6.25.0 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@6.25.0 (npm) is affected by GHSA-qrxm-fqhp-jwvm","path":"bun.lock","line":null,"fingerprint":"undici@6.25.0 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-rfgv-xxqx-mfg5","severity":"high","message":"undici@6.25.0 (npm) is affected by GHSA-rfgv-xxqx-mfg5","path":"bun.lock","line":null,"fingerprint":"undici@6.25.0 (npm):GHSA-rfgv-xxqx-mfg5"},{"rule_id":"osv/GHSA-vxpw-j846-p89q","severity":"high","message":"undici@6.25.0 (npm) is affected by GHSA-vxpw-j846-p89q","path":"bun.lock","line":null,"fingerprint":"undici@6.25.0 (npm):GHSA-vxpw-j846-p89q"},{"rule_id":"osv/GHSA-xjj6-f33q-929c","severity":"high","message":"undici@6.25.0 (npm) is affected by GHSA-xjj6-f33q-929c","path":"bun.lock","line":null,"fingerprint":"undici@6.25.0 (npm):GHSA-xjj6-f33q-929c"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@3.25.76 (npm) is affected by GHSA-mrhx-c7xc-m3w5; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"zod@3.25.76 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@4.3.6 (npm) is affected by GHSA-mrhx-c7xc-m3w5; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"zod@4.3.6 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-frvp-7c67-39w9","severity":"medium","message":"@hono/node-server@1.19.14 (npm) is affected by GHSA-frvp-7c67-39w9; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"@hono/node-server@1.19.14 (npm):GHSA-frvp-7c67-39w9"},{"rule_id":"osv/GHSA-jpvv-r467-5p4w","severity":"medium","message":"@hono/node-server@1.19.14 (npm) is affected by GHSA-jpvv-r467-5p4w; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"@hono/node-server@1.19.14 (npm):GHSA-jpvv-r467-5p4w"},{"rule_id":"osv/GHSA-rmxm-3fg6-px4f","severity":"medium","message":"@hono/node-server@1.19.14 (npm) is affected by GHSA-rmxm-3fg6-px4f; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"@hono/node-server@1.19.14 (npm):GHSA-rmxm-3fg6-px4f"},{"rule_id":"osv/GHSA-p498-v437-472g","severity":"medium","message":"@humanfs/node@0.16.7 (npm) is affected by GHSA-p498-v437-472g; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"@humanfs/node@0.16.7 (npm):GHSA-p498-v437-472g"},{"rule_id":"osv/GHSA-6prh-2h8m-c8cw","severity":"medium","message":"@modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-6prh-2h8m-c8cw; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.29.0 (npm):GHSA-6prh-2h8m-c8cw"},{"rule_id":"osv/GHSA-rvq5-wwqv-78pq","severity":"medium","message":"@modelcontextprotocol/sdk@1.29.0 (npm) is affected by GHSA-rvq5-wwqv-78pq; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"@modelcontextprotocol/sdk@1.29.0 (npm):GHSA-rvq5-wwqv-78pq"},{"rule_id":"osv/GHSA-c6fg-446q-cg94","severity":"medium","message":"adm-zip@0.5.17 (npm) is affected by GHSA-c6fg-446q-cg94","path":"bun.lock","line":null,"fingerprint":"adm-zip@0.5.17 (npm):GHSA-c6fg-446q-cg94"},{"rule_id":"osv/GHSA-p634-w6r4-rjp2","severity":"medium","message":"adm-zip@0.5.17 (npm) is affected by GHSA-p634-w6r4-rjp2","path":"bun.lock","line":null,"fingerprint":"adm-zip@0.5.17 (npm):GHSA-p634-w6r4-rjp2"},{"rule_id":"osv/GHSA-vwc7-r8mq-g2x9","severity":"medium","message":"adm-zip@0.5.17 (npm) is affected by GHSA-vwc7-r8mq-g2x9","path":"bun.lock","line":null,"fingerprint":"adm-zip@0.5.17 (npm):GHSA-vwc7-r8mq-g2x9"},{"rule_id":"osv/GHSA-w5vr-8v7q-w6rv","severity":"medium","message":"baseline-browser-mapping@2.10.19 (npm) is affected by GHSA-w5vr-8v7q-w6rv; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"baseline-browser-mapping@2.10.19 (npm):GHSA-w5vr-8v7q-w6rv"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.14 (npm) is affected by GHSA-q2hr-2g5m-vwhr; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"brace-expansion@1.1.14 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-jxxr-4gwj-5jf2","severity":"medium","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-jxxr-4gwj-5jf2; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-jxxr-4gwj-5jf2"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@5.0.5 (npm) is affected by GHSA-q2hr-2g5m-vwhr; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"brace-expansion@5.0.5 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-gcqx-w48m-w2h4","severity":"medium","message":"deepmerge@4.3.1 (npm) is affected by GHSA-gcqx-w48m-w2h4; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"deepmerge@4.3.1 (npm):GHSA-gcqx-w48m-w2h4"},{"rule_id":"osv/GHSA-hrr3-gc8f-f4qj","severity":"medium","message":"fast-uri@3.1.0 (npm) is affected by GHSA-hrr3-gc8f-f4qj; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-hrr3-gc8f-f4qj"},{"rule_id":"osv/GHSA-w74x-v6f9-j3xg","severity":"medium","message":"fast-uri@3.1.0 (npm) is affected by GHSA-w74x-v6f9-j3xg; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-w74x-v6f9-j3xg"},{"rule_id":"osv/GHSA-2gcr-mfcq-wcc3","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-2gcr-mfcq-wcc3; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-2gcr-mfcq-wcc3"},{"rule_id":"osv/GHSA-3hrh-pfw6-9m5x","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-3hrh-pfw6-9m5x; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-3hrh-pfw6-9m5x"},{"rule_id":"osv/GHSA-46wx-v44x-9hh2","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-46wx-v44x-9hh2; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-46wx-v44x-9hh2"},{"rule_id":"osv/GHSA-4h7h-rv7c-7m2v","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-4h7h-rv7c-7m2v; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-4h7h-rv7c-7m2v"},{"rule_id":"osv/GHSA-4m76-xfj5-7975","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-4m76-xfj5-7975; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-4m76-xfj5-7975"},{"rule_id":"osv/GHSA-54fx-42gc-7vw4","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-54fx-42gc-7vw4; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-54fx-42gc-7vw4"},{"rule_id":"osv/GHSA-5r4p-p66f-jhc7","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-5r4p-p66f-jhc7; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-5r4p-p66f-jhc7"},{"rule_id":"osv/GHSA-69xw-7hcm-h432","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-69xw-7hcm-h432; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-69xw-7hcm-h432"},{"rule_id":"osv/GHSA-8j4g-w8fx-2239","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-8j4g-w8fx-2239; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-8j4g-w8fx-2239"},{"rule_id":"osv/GHSA-9vqf-7f2p-gf9v","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-9vqf-7f2p-gf9v; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-9vqf-7f2p-gf9v"},{"rule_id":"osv/GHSA-crvj-82cr-hjcx","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-crvj-82cr-hjcx; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-crvj-82cr-hjcx"},{"rule_id":"osv/GHSA-f23p-vx2j-j53r","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-f23p-vx2j-j53r; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-f23p-vx2j-j53r"},{"rule_id":"osv/GHSA-f577-qrjj-4474","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-f577-qrjj-4474; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-f577-qrjj-4474"},{"rule_id":"osv/GHSA-g6gw-c38x-mqfc","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-g6gw-c38x-mqfc; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-g6gw-c38x-mqfc"},{"rule_id":"osv/GHSA-gqvv-2mrq-wpjv","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-gqvv-2mrq-wpjv; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-gqvv-2mrq-wpjv"},{"rule_id":"osv/GHSA-h7mg-cq63-vhpq","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-h7mg-cq63-vhpq; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-h7mg-cq63-vhpq"},{"rule_id":"osv/GHSA-hvrm-45r6-mjfj","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-hvrm-45r6-mjfj; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-hvrm-45r6-mjfj"},{"rule_id":"osv/GHSA-hxh3-vqpv-xpqv","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-hxh3-vqpv-xpqv; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-hxh3-vqpv-xpqv"},{"rule_id":"osv/GHSA-j6c9-x7qj-28xf","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-j6c9-x7qj-28xf; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-j6c9-x7qj-28xf"},{"rule_id":"osv/GHSA-p77w-8qqv-26rm","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-p77w-8qqv-26rm; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-p77w-8qqv-26rm"},{"rule_id":"osv/GHSA-qp7p-654g-cw7p","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-qp7p-654g-cw7p; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-qp7p-654g-cw7p"},{"rule_id":"osv/GHSA-rv63-4mwf-qqc2","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-rv63-4mwf-qqc2; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-rv63-4mwf-qqc2"},{"rule_id":"osv/GHSA-w62v-xxxg-mg59","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-w62v-xxxg-mg59; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-w62v-xxxg-mg59"},{"rule_id":"osv/GHSA-wgpf-jwqj-8h8p","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-wgpf-jwqj-8h8p; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-wgpf-jwqj-8h8p"},{"rule_id":"osv/GHSA-wwfh-h76j-fc44","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-wwfh-h76j-fc44; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-wwfh-h76j-fc44"},{"rule_id":"osv/GHSA-xgm2-5f3f-mvvc","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-xgm2-5f3f-mvvc; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-xgm2-5f3f-mvvc"},{"rule_id":"osv/GHSA-xrhx-7g5j-rcj5","severity":"medium","message":"hono@4.12.14 (npm) is affected by GHSA-xrhx-7g5j-rcj5; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-xrhx-7g5j-rcj5"},{"rule_id":"osv/GHSA-h3mg-xc3c-68pw","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-h3mg-xc3c-68pw; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-h3mg-xc3c-68pw"},{"rule_id":"osv/GHSA-j6r3-76f7-8jcv","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-j6r3-76f7-8jcv; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-j6r3-76f7-8jcv"},{"rule_id":"osv/GHSA-rpw4-54j3-4h4q","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-rpw4-54j3-4h4q; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-rpw4-54j3-4h4q"},{"rule_id":"osv/GHSA-rxp7-6hxx-x8q5","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-rxp7-6hxx-x8q5; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-rxp7-6hxx-x8q5"},{"rule_id":"osv/GHSA-v2v4-37r5-5v8g","severity":"medium","message":"ip-address@10.1.0 (npm) is affected by GHSA-v2v4-37r5-5v8g; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"ip-address@10.1.0 (npm):GHSA-v2v4-37r5-5v8g"},{"rule_id":"osv/GHSA-h67p-54hq-rp68","severity":"medium","message":"js-yaml@4.1.1 (npm) is affected by GHSA-h67p-54hq-rp68; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"js-yaml@4.1.1 (npm):GHSA-h67p-54hq-rp68"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@10.2.5 (npm) is affected by GHSA-g3hv-75wg-m249; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"minimatch@10.2.5 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-39w2-rjm5-chcv","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-39w2-rjm5-chcv; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-39w2-rjm5-chcv"},{"rule_id":"osv/GHSA-4633-3j49-mh5q","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-4633-3j49-mh5q; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-4633-3j49-mh5q"},{"rule_id":"osv/GHSA-4c39-4ccg-62r3","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-4c39-4ccg-62r3; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-4c39-4ccg-62r3"},{"rule_id":"osv/GHSA-4jqv-mc3x-m676","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-4jqv-mc3x-m676; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-4jqv-mc3x-m676"},{"rule_id":"osv/GHSA-68g3-v927-f742","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-68g3-v927-f742; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-68g3-v927-f742"},{"rule_id":"osv/GHSA-955p-x3mx-jcvp","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-955p-x3mx-jcvp; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-955p-x3mx-jcvp"},{"rule_id":"osv/GHSA-f87g-xv8r-7p7x","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-f87g-xv8r-7p7x; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-f87g-xv8r-7p7x"},{"rule_id":"osv/GHSA-ffhc-5mcf-pf4q","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-ffhc-5mcf-pf4q; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-ffhc-5mcf-pf4q"},{"rule_id":"osv/GHSA-gx5p-jg67-6x7h","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-gx5p-jg67-6x7h; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-gx5p-jg67-6x7h"},{"rule_id":"osv/GHSA-h64f-5h5j-jqjh","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-h64f-5h5j-jqjh; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-h64f-5h5j-jqjh"},{"rule_id":"osv/GHSA-mcj8-r9mp-w47p","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-mcj8-r9mp-w47p; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-mcj8-r9mp-w47p"},{"rule_id":"osv/GHSA-q8wf-6r8g-63ch","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-q8wf-6r8g-63ch; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-q8wf-6r8g-63ch"},{"rule_id":"osv/GHSA-wfc6-r584-vfw7","severity":"medium","message":"next@16.2.4 (npm) is affected by GHSA-wfc6-r584-vfw7; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-wfc6-r584-vfw7"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.4.31 (npm) is affected by GHSA-fxqj-rqcc-2cmp; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-qx2v-qp2m-jg93","severity":"medium","message":"postcss@8.4.31 (npm) is affected by GHSA-qx2v-qp2m-jg93; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-qx2v-qp2m-jg93"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.5.10 (npm) is affected by GHSA-fxqj-rqcc-2cmp; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"postcss@8.5.10 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-rj75-hqrm-r3gf","severity":"medium","message":"postcss-selector-parser@7.1.1 (npm) is affected by GHSA-rj75-hqrm-r3gf; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"postcss-selector-parser@7.1.1 (npm):GHSA-rj75-hqrm-r3gf"},{"rule_id":"osv/GHSA-w9m9-85wc-3x92","severity":"medium","message":"postcss-selector-parser@7.1.1 (npm) is affected by GHSA-w9m9-85wc-3x92; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"postcss-selector-parser@7.1.1 (npm):GHSA-w9m9-85wc-3x92"},{"rule_id":"osv/GHSA-j3f2-48v5-ccww","severity":"medium","message":"protobufjs@7.6.4 (npm) is affected by GHSA-j3f2-48v5-ccww","path":"bun.lock","line":null,"fingerprint":"protobufjs@7.6.4 (npm):GHSA-j3f2-48v5-ccww"},{"rule_id":"osv/GHSA-4mjr-xmp4-gh2g","severity":"medium","message":"qs@6.15.1 (npm) is affected by GHSA-4mjr-xmp4-gh2g; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"qs@6.15.1 (npm):GHSA-4mjr-xmp4-gh2g"},{"rule_id":"osv/GHSA-6pq8-jhm2-2vcw","severity":"medium","message":"qs@6.15.1 (npm) is affected by GHSA-6pq8-jhm2-2vcw; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"qs@6.15.1 (npm):GHSA-6pq8-jhm2-2vcw"},{"rule_id":"osv/GHSA-q8mj-m7cp-5q26","severity":"medium","message":"qs@6.15.1 (npm) is affected by GHSA-q8mj-m7cp-5q26; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"qs@6.15.1 (npm):GHSA-q8mj-m7cp-5q26"},{"rule_id":"osv/GHSA-x5fp-wj9c-mxmx","severity":"medium","message":"qs@6.15.1 (npm) is affected by GHSA-x5fp-wj9c-mxmx; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"qs@6.15.1 (npm):GHSA-x5fp-wj9c-mxmx"},{"rule_id":"osv/GHSA-3wwx-pv8p-q78v","severity":"medium","message":"undici@6.25.0 (npm) is affected by GHSA-3wwx-pv8p-q78v","path":"bun.lock","line":null,"fingerprint":"undici@6.25.0 (npm):GHSA-3wwx-pv8p-q78v"},{"rule_id":"osv/GHSA-4qv8-2p9j-2685","severity":"medium","message":"undici@6.25.0 (npm) is affected by GHSA-4qv8-2p9j-2685","path":"bun.lock","line":null,"fingerprint":"undici@6.25.0 (npm):GHSA-4qv8-2p9j-2685"},{"rule_id":"osv/GHSA-8xcm-r25x-g524","severity":"medium","message":"undici@6.25.0 (npm) is affected by GHSA-8xcm-r25x-g524","path":"bun.lock","line":null,"fingerprint":"undici@6.25.0 (npm):GHSA-8xcm-r25x-g524"},{"rule_id":"osv/GHSA-9fm3-97px-rjf6","severity":"medium","message":"undici@6.25.0 (npm) is affected by GHSA-9fm3-97px-rjf6","path":"bun.lock","line":null,"fingerprint":"undici@6.25.0 (npm):GHSA-9fm3-97px-rjf6"},{"rule_id":"osv/GHSA-m8rv-5g2x-5cg5","severity":"medium","message":"undici@6.25.0 (npm) is affected by GHSA-m8rv-5g2x-5cg5","path":"bun.lock","line":null,"fingerprint":"undici@6.25.0 (npm):GHSA-m8rv-5g2x-5cg5"},{"rule_id":"osv/GHSA-p88m-4jfj-68fv","severity":"medium","message":"undici@6.25.0 (npm) is affected by GHSA-p88m-4jfj-68fv","path":"bun.lock","line":null,"fingerprint":"undici@6.25.0 (npm):GHSA-p88m-4jfj-68fv"},{"rule_id":"osv/GHSA-v3r7-h72x-cjcm","severity":"medium","message":"undici@6.25.0 (npm) is affected by GHSA-v3r7-h72x-cjcm","path":"bun.lock","line":null,"fingerprint":"undici@6.25.0 (npm):GHSA-v3r7-h72x-cjcm"},{"rule_id":"osv/GHSA-4x5r-pxfx-6jf8","severity":"low","message":"@babel/core@7.29.0 (npm) is affected by GHSA-4x5r-pxfx-6jf8; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"@babel/core@7.29.0 (npm):GHSA-4x5r-pxfx-6jf8"},{"rule_id":"osv/GHSA-v422-hmwv-36x6","severity":"low","message":"body-parser@2.2.2 (npm) is affected by GHSA-v422-hmwv-36x6; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"body-parser@2.2.2 (npm):GHSA-v422-hmwv-36x6"},{"rule_id":"osv/GHSA-333x-w4r6-6crp","severity":"low","message":"fast-uri@3.1.0 (npm) is affected by GHSA-333x-w4r6-6crp; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-333x-w4r6-6crp"},{"rule_id":"osv/GHSA-xhq7-xmqj-769h","severity":"low","message":"fast-uri@3.1.0 (npm) is affected by GHSA-xhq7-xmqj-769h; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"fast-uri@3.1.0 (npm):GHSA-xhq7-xmqj-769h"},{"rule_id":"osv/GHSA-3gg2-335m-rxc6","severity":"low","message":"hono@4.12.14 (npm) is affected by GHSA-3gg2-335m-rxc6; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-3gg2-335m-rxc6"},{"rule_id":"osv/GHSA-79qm-7rj5-m7r9","severity":"low","message":"hono@4.12.14 (npm) is affected by GHSA-79qm-7rj5-m7r9; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-79qm-7rj5-m7r9"},{"rule_id":"osv/GHSA-hm8q-7f3q-5f36","severity":"low","message":"hono@4.12.14 (npm) is affected by GHSA-hm8q-7f3q-5f36; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"hono@4.12.14 (npm):GHSA-hm8q-7f3q-5f36"},{"rule_id":"osv/GHSA-3g8h-86w9-wvmq","severity":"low","message":"next@16.2.4 (npm) is affected by GHSA-3g8h-86w9-wvmq; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-3g8h-86w9-wvmq"},{"rule_id":"osv/GHSA-vfv6-92ff-j949","severity":"low","message":"next@16.2.4 (npm) is affected by GHSA-vfv6-92ff-j949; also in yarn.lock","path":"bun.lock","line":null,"fingerprint":"next@16.2.4 (npm):GHSA-vfv6-92ff-j949"},{"rule_id":"osv/GHSA-35p6-xmwp-9g52","severity":"low","message":"undici@6.25.0 (npm) is affected by GHSA-35p6-xmwp-9g52","path":"bun.lock","line":null,"fingerprint":"undici@6.25.0 (npm):GHSA-35p6-xmwp-9g52"},{"rule_id":"osv/GHSA-g8m3-5g58-fq7m","severity":"low","message":"undici@6.25.0 (npm) is affected by GHSA-g8m3-5g58-fq7m","path":"bun.lock","line":null,"fingerprint":"undici@6.25.0 (npm):GHSA-g8m3-5g58-fq7m"},{"rule_id":"osv/GHSA-r53p-7pc4-xj5r","severity":"low","message":"undici@6.25.0 (npm) is affected by GHSA-r53p-7pc4-xj5r","path":"bun.lock","line":null,"fingerprint":"undici@6.25.0 (npm):GHSA-r53p-7pc4-xj5r"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":4.0,"findings_high":2.0,"findings_medium":2.0,"findings_low":0.0,"penalty":27.6},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/bench-ci.yml","line":32,"fingerprint":"unpinned-uses:.github/workflows/bench-ci.yml:32"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/bench-ci.yml","line":35,"fingerprint":"unpinned-uses:.github/workflows/bench-ci.yml:35"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/bench-ci.yml","line":32,"fingerprint":"artipacked:.github/workflows/bench-ci.yml:32"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/bench-ci.yml","line":28,"fingerprint":"excessive-permissions:.github/workflows/bench-ci.yml:28"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":0.0,"signed_commit_share":0.0,"unpinned_manifests":4.0},"findings":[],"evidence":[{"kind":"posture","description":"packages/mcp/bench/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/mcp/bench/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/mcp/server/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/mcp/server/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/next/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/next/package.json","url":null,"weight":0.3},{"kind":"posture","description":"packages/shared/package.json has no lockfile alongside it (unpinned dependencies)","ref":"packages/shared/package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1509.0,"function_nloc":18093.0,"mean_ccn":2.68,"p90_ccn":6.0,"complex_functions":15.0,"long_functions":11.0,"many_param_functions":1.0,"risky_nloc_share":0.1554},"findings":[],"evidence":[{"kind":"complex-function","description":"runRun in packages/mcp/bench/cli/run.ts: complexity 99, 597 lines","ref":"packages/mcp/bench/cli/run.ts","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/cli/run.ts#L80","weight":1.0},{"kind":"complex-function","description":"main in packages/mcp/bench/scripts/author-double-queries.ts: complexity 33, 76 lines","ref":"packages/mcp/bench/scripts/author-double-queries.ts","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/scripts/author-double-queries.ts#L153","weight":0.55},{"kind":"complex-function","description":"runRunHoldout in packages/mcp/bench/cli/holdout.ts: complexity 27, 200 lines","ref":"packages/mcp/bench/cli/holdout.ts","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/cli/holdout.ts#L291","weight":0.45},{"kind":"complex-function","description":"dispatch in packages/mcp/bench/cli/bench.ts: complexity 26, 56 lines","ref":"packages/mcp/bench/cli/bench.ts","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/cli/bench.ts#L80","weight":0.43333333333333335},{"kind":"complex-function","description":"runFreeze in packages/mcp/bench/cli/freeze.ts: complexity 21, 75 lines","ref":"packages/mcp/bench/cli/freeze.ts","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/cli/freeze.ts#L36","weight":0.35},{"kind":"complex-function","description":"main in packages/mcp/bench/scripts/triage-multihop.ts: complexity 21, 74 lines","ref":"packages/mcp/bench/scripts/triage-multihop.ts","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/scripts/triage-multihop.ts#L156","weight":0.35},{"kind":"complex-function","description":"handleProgress in packages/mcp/bench/src/dashboard/public/app.js: complexity 20, 34 lines","ref":"packages/mcp/bench/src/dashboard/public/app.js","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/src/dashboard/public/app.js#L684","weight":0.3333333333333333},{"kind":"complex-function","description":"ingestPath in packages/mcp/ingest/src/pipeline/ingest.ts: complexity 20, 123 lines","ref":"packages/mcp/ingest/src/pipeline/ingest.ts","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/ingest/src/pipeline/ingest.ts#L389","weight":0.3333333333333333},{"kind":"complex-function","description":"runMeasureNoiseFloor in packages/mcp/bench/cli/measure.ts: complexity 18, 88 lines","ref":"packages/mcp/bench/cli/measure.ts","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/cli/measure.ts#L117","weight":0.3},{"kind":"complex-function","description":"loadGolden in packages/mcp/bench/src/dashboard/reader.ts: complexity 18, 43 lines","ref":"packages/mcp/bench/src/dashboard/reader.ts","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/src/dashboard/reader.ts#L273","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":23526.0,"duplicated_lines":825.0,"duplicated_share":0.0351,"files":243.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: packages/mcp/bench/cli/holdout.ts:543 and packages/mcp/bench/cli/score.ts:29","ref":"packages/mcp/bench/cli/holdout.ts","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/cli/holdout.ts#L543","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/mcp/bench/cli/run.ts:432 and packages/mcp/bench/cli/run.ts:715","ref":"packages/mcp/bench/cli/run.ts","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/cli/run.ts#L432","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/mcp/bench/src/lib/fixture-lock.ts:212 and packages/mcp/bench/src/lib/holdout-lock.ts:140","ref":"packages/mcp/bench/src/lib/fixture-lock.ts","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/src/lib/fixture-lock.ts#L212","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/mcp/bench/src/lib/holdout-score.ts:199 and packages/mcp/bench/src/stages/09-score.ts:343","ref":"packages/mcp/bench/src/lib/holdout-score.ts","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/src/lib/holdout-score.ts#L199","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/mcp/bench/src/lib/prompts.ts:18 and packages/mcp/ingest/src/lib/prompts.ts:18","ref":"packages/mcp/bench/src/lib/prompts.ts","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/src/lib/prompts.ts#L18","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/mcp/bench/src/lib/source-root.ts:17 and packages/mcp/ingest/src/pipeline/ingest.ts:58","ref":"packages/mcp/bench/src/lib/source-root.ts","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/src/lib/source-root.ts#L17","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/mcp/bench/src/providers/anthropic.ts:32 and packages/mcp/bench/src/providers/deepseek.ts:30","ref":"packages/mcp/bench/src/providers/anthropic.ts","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/src/providers/anthropic.ts#L32","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/mcp/bench/src/retriever/bm25.ts:62 and packages/mcp/ingest/src/lib/embedder/bm25.ts:46","ref":"packages/mcp/bench/src/retriever/bm25.ts","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/src/retriever/bm25.ts#L62","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/mcp/bench/src/retriever/rrf.ts:26 and packages/mcp/ingest/src/retriever/rrf.ts:28","ref":"packages/mcp/bench/src/retriever/rrf.ts","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/src/retriever/rrf.ts#L26","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: packages/mcp/bench/src/stages/03-queries.ts:217 and packages/mcp/bench/src/stages/03-queries.ts:483","ref":"packages/mcp/bench/src/stages/03-queries.ts","url":"https://github.com/ItsNotCam/june/blob/a4217b8ea8f5e5d3bb6b29d0eb6dea55aab4cc08/packages/mcp/bench/src/stages/03-queries.ts#L217","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":53.0,"weighted_findings":43.25,"scanned_lines":31868.0,"category:best-practice":39.0,"category:correctness":14.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"packages/mcp/bench/scripts/assemble-verdicts.py","line":11,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:packages/mcp/bench/scripts/assemble-verdicts.py:11"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"packages/mcp/bench/scripts/assemble-verdicts.py","line":12,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:packages/mcp/bench/scripts/assemble-verdicts.py:12"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"packages/mcp/bench/scripts/assemble-verdicts.py","line":35,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:packages/mcp/bench/scripts/assemble-verdicts.py:35"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"packages/mcp/bench/src/providers/ollama.ts","line":121,"fingerprint":"javascript.lang.correctness.no-stringify-keys:packages/mcp/bench/src/providers/ollama.ts:121"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/button.tsx","line":54,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/button.tsx:54"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/card.tsx","line":19,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/card.tsx:19"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/card.tsx","line":32,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/card.tsx:32"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/card.tsx","line":45,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/card.tsx:45"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/card.tsx","line":55,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/card.tsx:55"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/card.tsx","line":68,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/card.tsx:68"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/card.tsx","line":78,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/card.tsx:78"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/card.tsx","line":91,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/card.tsx:91"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/chart.tsx","line":72,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/chart.tsx:72"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/input.tsx","line":15,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/input.tsx:15"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/label.tsx","line":15,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/label.tsx:15"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/markdown.tsx","line":17,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/markdown.tsx:17"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/markdown.tsx","line":20,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/markdown.tsx:20"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/markdown.tsx","line":23,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/markdown.tsx:23"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/markdown.tsx","line":25,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/markdown.tsx:25"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/markdown.tsx","line":26,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/markdown.tsx:26"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/markdown.tsx","line":27,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/markdown.tsx:27"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/markdown.tsx","line":28,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/markdown.tsx:28"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/markdown.tsx","line":29,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/markdown.tsx:29"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/markdown.tsx","line":31,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/markdown.tsx:31"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/markdown.tsx","line":33,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/markdown.tsx:33"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/markdown.tsx","line":35,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/markdown.tsx:35"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/markdown.tsx","line":39,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/markdown.tsx:39"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/markdown.tsx","line":43,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/markdown.tsx:43"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/markdown.tsx","line":46,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/markdown.tsx:46"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/select.tsx","line":16,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/select.tsx:16"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/select.tsx","line":26,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/select.tsx:26"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/select.tsx","line":47,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/select.tsx:47"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/select.tsx","line":87,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/select.tsx:87"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/select.tsx","line":106,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/select.tsx:106"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/select.tsx","line":123,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/select.tsx:123"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/select.tsx","line":147,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/select.tsx:147"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/select.tsx","line":163,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/select.tsx:163"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/select.tsx","line":182,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/select.tsx:182"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/shadcn/switch.tsx","line":22,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/shadcn/switch.tsx:22"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"packages/next/components/theme/ThemeProvider.tsx","line":8,"fingerprint":"typescript.react.best-practice.react-props-spreading:packages/next/components/theme/ThemeProvider.tsx:8"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/mcp/bench/cli/author.ts","line":185,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/mcp/bench/cli/author.ts:185"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/mcp/bench/cli/author.ts","line":185,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/mcp/bench/cli/author.ts:185"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/mcp/bench/cli/holdout.ts","line":559,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/mcp/bench/cli/holdout.ts:559"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/mcp/bench/cli/holdout.ts","line":559,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/mcp/bench/cli/holdout.ts:559"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/mcp/bench/cli/holdout.ts","line":559,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/mcp/bench/cli/holdout.ts:559"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/mcp/bench/cli/holdout.ts","line":701,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/mcp/bench/cli/holdout.ts:701"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/mcp/bench/cli/holdout.ts","line":701,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/mcp/bench/cli/holdout.ts:701"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/mcp/bench/cli/validate-judge.ts","line":172,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/mcp/bench/cli/validate-judge.ts:172"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/mcp/bench/cli/validate-judge.ts","line":172,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/mcp/bench/cli/validate-judge.ts:172"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/mcp/bench/src/dashboard/public/app.js","line":386,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/mcp/bench/src/dashboard/public/app.js:386"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/mcp/bench/src/dashboard/public/app.js","line":386,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/mcp/bench/src/dashboard/public/app.js:386"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/next/app/preview/_components/HslColorPicker.tsx","line":110,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/next/app/preview/_components/HslColorPicker.tsx:110"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"packages/next/app/preview/_components/HslColorPicker.tsx","line":110,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:packages/next/app/preview/_components/HslColorPicker.tsx:110"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.6881,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":11015.0,"source_lines":32015.0,"test_ratio":0.3441,"ci_files":1.0,"cochange_share":0.4691,"cochange_commits":81.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/bench-ci.yml","ref":".github/workflows/bench-ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (bun test)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["bun test"],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":0.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":40.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.9988,"check:low_escape_density":1.0,"escapes":12.0,"escapes_per_kloc":0.391},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: packages/next/tsconfig.json","ref":"packages/next/tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":9709.0,"other_lines":22306.0,"files_blamed":243.0,"blame_failures":0.0,"quality:ai_findings":3.0,"quality:ai_per_kloc":0.309,"quality:other_findings":50.0,"quality:other_per_kloc":2.242,"quality:ratio":0.14,"security:ai_findings":47.0,"security:ai_per_kloc":4.841,"security:other_findings":253.0,"security:other_per_kloc":11.342,"security:ratio":0.43},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}