{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:19:16.220543Z","repo":{"ref":{"host":"github.com","owner":"JaeMoonNoh","name":"toddler-content"},"default_branch":"main","clone_url":"https://github.com/JaeMoonNoh/toddler-content.git","html_url":"https://github.com/JaeMoonNoh/toddler-content","description":null,"stars":0,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":1418,"primary_language":"TypeScript","license_spdx":"MIT","created_at":"2026-11-02T00:26:15Z","pushed_at":"2026-11-10T06:37:50Z","security_policy_url":null,"distribution":{"owner_created_at":"2020-03-17T05:50:23Z","owner_type":"User","release_assets":[]}},"commit_sha":"395c494306663cbc5bc64d8feb8277b6d18a072c","profile":{"lines_by_language":{"TypeScript":17486,"SQL":252,"JavaScript":100},"files_by_category":{"source":202,"test":102,"docs":26,"config":19,"other":6,"oversized":1,"generated":1},"source_lines":9496,"test_lines":8342},"pillars":{"ai_provenance":{"score":100.0,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":1.0,"suspected_share":0.0,"estimated_share":1.0,"ai_artifacts":1.0,"flagged_work_units":2.0,"flagged_releases":null},"summary":"Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals."},"quality":{"score":79.9,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":94.9,"duplication":98.6,"lint":86.2,"testing":55.0,"docs":65.0,"type_safety":100.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.88, no CI test run detected; 2% of function code in complex or long functions; 0% duplicated lines. Weakest area: testing."},"security":{"score":83.5,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":96.3,"dependencies":81.9,"ci_actions":null,"posture":20.0,"scorecard":null},"summary":"Security posture is adequate: 4 known vulnerabilities in 3 dependencies. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":36.0,"checked":36.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":107.0,"attributed_commits":106.0,"attributed_commit_share":0.9906542056074766,"effective_loc":20219.0,"attributed_loc":20219.0,"attributed_loc_share":1.0,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 106 attributed commits, 20,219 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"395c494306663cbc5bc64d8feb8277b6d18a072c","url":"https://github.com/JaeMoonNoh/toddler-content/commit/395c494306663cbc5bc64d8feb8277b6d18a072c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"a4748e72e87060f917aefd02af8ba45cf48b7cd5","url":"https://github.com/JaeMoonNoh/toddler-content/commit/a4748e72e87060f917aefd02af8ba45cf48b7cd5","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"4b5613c366675425a586cca53dabaa967e29b854","url":"https://github.com/JaeMoonNoh/toddler-content/commit/4b5613c366675425a586cca53dabaa967e29b854","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"9d8d8bc00c131fcb7f1859f91f3003350c30b567","url":"https://github.com/JaeMoonNoh/toddler-content/commit/9d8d8bc00c131fcb7f1859f91f3003350c30b567","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"6f970b19e4abbab73312248cae7a8e0b60c37b17","url":"https://github.com/JaeMoonNoh/toddler-content/commit/6f970b19e4abbab73312248cae7a8e0b60c37b17","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"4463f792056ffcde3c18630ae51d780e1310dd35","url":"https://github.com/JaeMoonNoh/toddler-content/commit/4463f792056ffcde3c18630ae51d780e1310dd35","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"21bb926be08ce61daac4d084324a0625178e7781","url":"https://github.com/JaeMoonNoh/toddler-content/commit/21bb926be08ce61daac4d084324a0625178e7781","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"181995a6a5fea94d41fb0a07ced5467cc163a747","url":"https://github.com/JaeMoonNoh/toddler-content/commit/181995a6a5fea94d41fb0a07ced5467cc163a747","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"98f7e9abc65445a408b9da7296b861db924e5c9a","url":"https://github.com/JaeMoonNoh/toddler-content/commit/98f7e9abc65445a408b9da7296b861db924e5c9a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"40496b53a8adffb1e116e2ac7b10a245ec266a1a","url":"https://github.com/JaeMoonNoh/toddler-content/commit/40496b53a8adffb1e116e2ac7b10a245ec266a1a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"cbce8dc55c09986bc8f36dc4b19298c0aa75ad9a","url":"https://github.com/JaeMoonNoh/toddler-content/commit/cbce8dc55c09986bc8f36dc4b19298c0aa75ad9a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"4d2cda88bad4a45fee07e9955e730dc52644fb34","url":"https://github.com/JaeMoonNoh/toddler-content/commit/4d2cda88bad4a45fee07e9955e730dc52644fb34","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"e53eeb233019f43ba53eb1b763518fe06b7d9ef5","url":"https://github.com/JaeMoonNoh/toddler-content/commit/e53eeb233019f43ba53eb1b763518fe06b7d9ef5","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"69231eb4ed9b294b3d588c36552d6befab81274c","url":"https://github.com/JaeMoonNoh/toddler-content/commit/69231eb4ed9b294b3d588c36552d6befab81274c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"139f0e699b5c1f53a5e3fcccf2b05d86e5253fba","url":"https://github.com/JaeMoonNoh/toddler-content/commit/139f0e699b5c1f53a5e3fcccf2b05d86e5253fba","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"32c4d341c8760d41103a7eab432d6814a47c870c","url":"https://github.com/JaeMoonNoh/toddler-content/commit/32c4d341c8760d41103a7eab432d6814a47c870c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"7607207378f0fb7faaa6bdc364dbfd58d2647d20","url":"https://github.com/JaeMoonNoh/toddler-content/commit/7607207378f0fb7faaa6bdc364dbfd58d2647d20","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"c688e1802c8cb5d4ce366443bc2c2ab7c6f1001c","url":"https://github.com/JaeMoonNoh/toddler-content/commit/c688e1802c8cb5d4ce366443bc2c2ab7c6f1001c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"3a69b2b6266a7aa721e6c97ae086adf23d8fc9ba","url":"https://github.com/JaeMoonNoh/toddler-content/commit/3a69b2b6266a7aa721e6c97ae086adf23d8fc9ba","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"55c9032cf55b076d3f6ebec3b64d968a98aaa4aa","url":"https://github.com/JaeMoonNoh/toddler-content/commit/55c9032cf55b076d3f6ebec3b64d968a98aaa4aa","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"ba3bc8a6fee195d3db6dffa1d8b0167ed4ca753d","url":"https://github.com/JaeMoonNoh/toddler-content/commit/ba3bc8a6fee195d3db6dffa1d8b0167ed4ca753d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"8866f3234fd6654e92d53ffb821d0b63ef765373","url":"https://github.com/JaeMoonNoh/toddler-content/commit/8866f3234fd6654e92d53ffb821d0b63ef765373","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"2bd95efefbebda2e4145a57945a4fee3cdd7a2c1","url":"https://github.com/JaeMoonNoh/toddler-content/commit/2bd95efefbebda2e4145a57945a4fee3cdd7a2c1","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"f06d460dffec472d7cb19625efc2cd921095688d","url":"https://github.com/JaeMoonNoh/toddler-content/commit/f06d460dffec472d7cb19625efc2cd921095688d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"fae40658ac70f762b268e7a59c5b85828287d9c0","url":"https://github.com/JaeMoonNoh/toddler-content/commit/fae40658ac70f762b268e7a59c5b85828287d9c0","weight":0.9}],"data":{"attributed_loc_by_commit":{"e2adf36d5a29166405bc3a02a66a83ef8e8d7b3a":0,"0617da6dfdbac203eb6638abb8de24e7b9461419":0,"901685dd83d00e87e149be5f46732e6b0b7cbea0":79,"ee61ebe077fe9646938442da6ea5cf0b48f8d483":0,"b847f6ddf26761b4cd1675d708b496d9de1cd10e":0,"fba50f0322c13fb91c4d8d8378d5f550e0e632e3":67,"0c6faed8dd761fb8b981f3019bbed1d2cbee10ee":0,"c921ce8e67a568508ffe42785c949fc19bf26977":442,"e0dd117a65b71c63d24f79f598a717e5286a66d0":638,"761380f4766a4f8c71757b46c959f031f5d44c5e":0,"91501b0a6d1b3ee17df191f4888e7f4ed4722236":1483,"79bd11eeb8b7a7308101d4cdfa7659bc9beb3399":1524,"e41930690a0c1cf92841e328c571a609757cc16c":426,"25a24ddbb21ff9698bdac363950a24e3f3b339b2":557,"42513183fc475081ea20618ec3f732a7648f098b":312,"2bd24051d334e4d20248f4ad678e1aba9258b997":299,"7e337fa94106cce3e2b18a651625068799454b44":374,"b347f840ddebe05211beaeff7b8ea11ad72750d0":546,"53ab38c819265b4f460481fb0a478e8082c084fa":113,"dda32053b5383bfbea7cd48a5f75b53fbe9601dd":277,"b9f8b57e7f77d17036d9619c04d8ed084bcd4b59":0,"31688526b060bf714f3266a528d021edea7b8bb6":0,"da364948ad71fab016bc55585157ee4e7c1c10bb":0,"d90c583c76a9a8db10809f6405a23a0cfd7bdb12":240,"cf334913a15327004487daf37c8e394043247149":0,"423aaf70fffcc40e31ede781e6c1d82b40f84cb2":0,"034ef284aa0529a71ac31b14e5680579e3470b71":0,"f3e42b494f8f20b3147322ae9ce3908ed7ef0601":21,"d7b05379a912ef592229cb3cefb2302420675dbe":0,"71f9c2620074e996af8d83335c0f7e99903216a9":2,"8c02f4dfe2fb26e44bc8baed25c3c5705503a6a7":215,"093bf7f56d5993871d2042fb2658d3a096d4af77":0,"10f17e6d08fa71f9beb4bf2634b610819880086e":32,"31bc660ff9b3dcaa063f441050aa8c5cf3eda9b1":0,"fe816268ca3df0b91d19c3f49d67d107646c7427":81,"7abe8b76f6ebe91875a0f8b5961ea064df4467a9":704,"93867e07b14ae36da67138652d11084c05abfe3c":0,"2b6300ed2b77990569368fb061ff8bf40e64f769":107,"3f37edc3ce36f12fce2a7244c6fc3265117da642":496,"bedcf22a8082e14d166e6023e1a2930c4fbd0eb4":426,"99d7452bfd30d8d37e3e3ee537cb7bad08d81622":56,"0cde293f64fff51daacf7b45ecd7c98148ccfddc":0,"1acdece1140f77a195eb388319f6993273c88be7":0,"e75b9d54ae45665bc6346231a517dce789c2ea09":124,"ec71ef5be1c861e516e0926411385b6679b304ee":0,"359493e4e553357c83fd588ae85eee93c2a885b1":0,"1fe1f744d3dd6f09d2cdcfba8529b6990b2b712a":712,"734367edf74a67eca06ccb5cb4ab538ddf069532":364,"c0fd97bdb60ac13f9775a99a7e828da263917ba7":518,"e3f2f0fdcd4b34f69b5041efedbe376e6372b670":0,"37d075520bc8f54009ed15adae8b60c4a8433bf2":0,"b60535302e90ccec9f05052a6b681a2b09ab9f63":0,"6bd027939ad4f62414319f6a55fe895e7011a4b6":0,"1d823ad208389910810d1f0cab9fb5ad69b6fa9c":447,"963e788cd83657d667f5cea1c47d1f55305fc4c7":0,"308e41baf9156b494ea8e08262acefc790f6d55c":0,"76df92560132b6e9b224e64fddd39d4a989728ef":0,"a0136643d1ce31d66372880f97eaed7bc49588be":0,"8a73608bd2c308e1e08e1c44889cd49aad1b7441":0,"634245154e726fcc91f27bacc7d30dd5579938d2":660,"52fe48dc2a34b2300709372cbc6854a7d60018c6":0,"8d0147c896310168ef4da33133ca276981ed8598":0,"e3173c54cd2bc2b0fb02ef6c1e11b15e383ff406":0,"ae2464fc26dfa4fad6f3f694cf7d72bcf8bc86cf":502,"b4c5d633d5b0d87e2b45d4d85c8a88f3c5c5e1a8":0,"f4d46cadaec0e7ebf1bf8ccb6c5434eea2b7ea37":0,"6cacc5941fca07011676233b3d056d72ebd4a44a":0,"3bfac6c51ff56eb55208e05d1da13dfa6a242c5d":0,"c58e5bb73b24f2a0cb2b041bb9b975d923f41015":108,"ff10cd84344dc01c25637687d2498f29d867cf6b":475,"3da53735aa9f0e4d4b1827c542941075a4b76ec4":236,"58f5e1ff632251b693b8d6e81ca1cc6f95889bb4":148,"771623b4ac5bfd7c73f66c525492d03208d42473":1,"1e63a036105736b36f667922804569bc85fe92d0":921,"05aed051e47fb643b4e3657a293a6d8e3926b17a":755,"3b58fe2206b6690059b81854c07acf4e1a0b6a0f":471,"a10f74ba1610d31900131f71486225ca0bbe9281":278,"8099352a38055671d1f97adac6fdefd4db6d648f":79,"4d015312cf26cb1cfa823071cb73f7600587ba2b":496,"9bc463ee1b967979390cced8eb80c6c933797bfa":63,"9654fe92dfe17a60e70236ecf3b091bfe4728c4a":0,"fae40658ac70f762b268e7a59c5b85828287d9c0":0,"f06d460dffec472d7cb19625efc2cd921095688d":0,"2bd95efefbebda2e4145a57945a4fee3cdd7a2c1":111,"8866f3234fd6654e92d53ffb821d0b63ef765373":0,"ba3bc8a6fee195d3db6dffa1d8b0167ed4ca753d":0,"55c9032cf55b076d3f6ebec3b64d968a98aaa4aa":0,"3a69b2b6266a7aa721e6c97ae086adf23d8fc9ba":0,"c688e1802c8cb5d4ce366443bc2c2ab7c6f1001c":0,"7607207378f0fb7faaa6bdc364dbfd58d2647d20":0,"32c4d341c8760d41103a7eab432d6814a47c870c":0,"139f0e699b5c1f53a5e3fcccf2b05d86e5253fba":0,"69231eb4ed9b294b3d588c36552d6befab81274c":0,"e53eeb233019f43ba53eb1b763518fe06b7d9ef5":0,"4d2cda88bad4a45fee07e9955e730dc52644fb34":0,"cbce8dc55c09986bc8f36dc4b19298c0aa75ad9a":0,"40496b53a8adffb1e116e2ac7b10a245ec266a1a":0,"98f7e9abc65445a408b9da7296b861db924e5c9a":1,"181995a6a5fea94d41fb0a07ced5467cc163a747":0,"21bb926be08ce61daac4d084324a0625178e7781":282,"4463f792056ffcde3c18630ae51d780e1310dd35":321,"6f970b19e4abbab73312248cae7a8e0b60c37b17":933,"9d8d8bc00c131fcb7f1859f91f3003350c30b567":685,"4b5613c366675425a586cca53dabaa967e29b854":598,"a4748e72e87060f917aefd02af8ba45cf48b7cd5":409,"395c494306663cbc5bc64d8feb8277b6d18a072c":4},"tools":{"claude-code":{"name":"Claude Code","commits":106,"loc":20219,"first_seen":1793579798,"last_seen":1794292667}},"monthly":{"2026-11":{"loc":20219,"attributed_loc":20219}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":1.0,"workflow_agents":0.0,"tools_configured":1.0,"earliest_adoption":1793580361.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/JaeMoonNoh/toddler-content/blob/395c494306663cbc5bc64d8feb8277b6d18a072c/CLAUDE.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1793580361}],"workflows":[],"tools":["claude-code"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":53.0,"flagged_units":2.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":20219.0,"flagged_loc":3007.0,"flagged_loc_share":0.14872149957960334,"max_loc_per_hour":1704.109589041096,"median_loc_per_hour":598.0,"pr_timed_units":53.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"1,524 lines of first-party code in ~1.2h (1,263 lines/hour, PR #11)","ref":"79bd11eeb8b7a7308101d4cdfa7659bc9beb3399","url":"https://github.com/JaeMoonNoh/toddler-content/commit/79bd11eeb8b7a7308101d4cdfa7659bc9beb3399","weight":0.37889502762430943},{"kind":"velocity-burst","description":"1,483 lines of first-party code in ~1.5h (973 lines/hour, PR #10)","ref":"91501b0a6d1b3ee17df191f4888e7f4ed4722236","url":"https://github.com/JaeMoonNoh/toddler-content/commit/91501b0a6d1b3ee17df191f4888e7f4ed4722236","weight":0.29200364630811304}],"data":{"flagged_loc_by_commit":{"91501b0a6d1b3ee17df191f4888e7f4ed4722236":1483,"79bd11eeb8b7a7308101d4cdfa7659bc9beb3399":1524},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":9496.0,"index":1.106,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":21.0,"per_kloc:emoji_in_code":2.211,"files:emoji_in_code":4.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":4.0,"findings_high":0.0,"findings_medium":4.0,"findings_low":0.0,"weighted_findings":1.0,"scanned_lines":9244.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^[a-z0-9]+(-[a-z0-9]+)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a library whi [confidence low]","path":"apps/api/src/benefit/domain/benefit.ts","line":223,"fingerprint":"javascript.lang.security.audit.detect-redos:apps/api/src/benefit/domain/benefit.ts:223"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"apps/api/src/benefit/infrastructure/cli/benefit.cli.ts","line":206,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:apps/api/src/benefit/infrastructure/cli/benefit.cli.ts:206"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"apps/api/src/benefit/infrastructure/cli/review-printer.ts","line":76,"fingerprint":"javascript.lang.security.html-in-template-string:apps/api/src/benefit/infrastructure/cli/review-printer.ts:76"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"apps/api/src/logging/request-logging.middleware.ts","line":20,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:apps/api/src/logging/request-logging.middleware.ts:20"}],"evidence":[],"data":{"rulesets":["typescript","javascript","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":3.0,"vulnerabilities":4.0,"vulns_critical":0.0,"vulns_high":1.0,"vulns_medium":2.0,"vulns_low":1.0,"vulns_unknown":0.0,"penalty":12.0},"findings":[{"rule_id":"osv/GHSA-r5fr-rjxr-66jc","severity":"high","message":"lodash@4.17.21 (npm) is affected by GHSA-r5fr-rjxr-66jc","path":"pnpm-lock.yaml","line":null,"fingerprint":"lodash@4.17.21 (npm):GHSA-r5fr-rjxr-66jc"},{"rule_id":"osv/GHSA-xxjr-mmjv-4gpg","severity":"medium","message":"lodash@4.17.21 (npm) is affected by GHSA-xxjr-mmjv-4gpg","path":"pnpm-lock.yaml","line":null,"fingerprint":"lodash@4.17.21 (npm):GHSA-xxjr-mmjv-4gpg"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@10.2.6 (npm) is affected by GHSA-g3hv-75wg-m249","path":"pnpm-lock.yaml","line":null,"fingerprint":"minimatch@10.2.6 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-474x-hrwr-fgx4","severity":"low","message":"fast-xml-parser@5.11.2 (npm) is affected by GHSA-474x-hrwr-fgx4","path":"pnpm-lock.yaml","line":null,"fingerprint":"fast-xml-parser@5.11.2 (npm):GHSA-474x-hrwr-fgx4"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":0.0,"signed_commit_share":0.972,"unpinned_manifests":2.0},"findings":[],"evidence":[{"kind":"posture","description":"apps/api/package.json has no lockfile alongside it (unpinned dependencies)","ref":"apps/api/package.json","url":null,"weight":0.3},{"kind":"posture","description":"apps/web/package.json has no lockfile alongside it (unpinned dependencies)","ref":"apps/web/package.json","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1119.0,"function_nloc":5527.0,"mean_ccn":1.96,"p90_ccn":4.0,"complex_functions":1.0,"long_functions":0.0,"many_param_functions":0.0,"risky_nloc_share":0.0174},"findings":[],"evidence":[{"kind":"complex-function","description":"BenefitFinder in apps/web/src/benefits/ui/benefit-finder.tsx: complexity 31, 96 lines","ref":"apps/web/src/benefits/ui/benefit-finder.tsx","url":"https://github.com/JaeMoonNoh/toddler-content/blob/395c494306663cbc5bc64d8feb8277b6d18a072c/apps/web/src/benefits/ui/benefit-finder.tsx#L37","weight":0.5166666666666667}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":6144.0,"duplicated_lines":14.0,"duplicated_share":0.0023,"files":202.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: apps/web/src/benefits/ui/audience-groups.tsx:17 and apps/web/src/benefits/ui/benefit-groups.tsx:8","ref":"apps/web/src/benefits/ui/audience-groups.tsx","url":"https://github.com/JaeMoonNoh/toddler-content/blob/395c494306663cbc5bc64d8feb8277b6d18a072c/apps/web/src/benefits/ui/audience-groups.tsx#L17","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":16.0,"weighted_findings":5.5,"scanned_lines":9244.0,"category:correctness":16.0},"findings":[{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"apps/web/src/benefits/domain/benefit.ts","line":98,"fingerprint":"javascript.lang.correctness.no-replaceall:apps/web/src/benefits/domain/benefit.ts:98"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"apps/web/src/benefits/domain/calendar-date.ts","line":56,"fingerprint":"javascript.lang.correctness.no-replaceall:apps/web/src/benefits/domain/calendar-date.ts:56"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/benefit/application/benefit-plan.service.ts","line":95,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/benefit/application/benefit-plan.service.ts:95"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/benefit/application/benefit-plan.service.ts","line":95,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/benefit/application/benefit-plan.service.ts:95"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/benefit/application/benefit-plan.service.ts","line":95,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/benefit/application/benefit-plan.service.ts:95"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/benefit/application/benefit-plan.service.ts","line":95,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/benefit/application/benefit-plan.service.ts:95"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/benefit/application/benefit-plan.service.ts","line":95,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/benefit/application/benefit-plan.service.ts:95"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/benefit/infrastructure/cli/change-text-printer.ts","line":56,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/benefit/infrastructure/cli/change-text-printer.ts:56"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/benefit/infrastructure/cli/change-text-printer.ts","line":56,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/benefit/infrastructure/cli/change-text-printer.ts:56"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/config/env.validation.ts","line":54,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/config/env.validation.ts:54"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/config/env.validation.ts","line":54,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/config/env.validation.ts:54"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/config/env.validation.ts","line":54,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/config/env.validation.ts:54"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/config/env.validation.ts","line":54,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/config/env.validation.ts:54"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/config/env.validation.ts","line":54,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/config/env.validation.ts:54"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/region/infrastructure/catalog/json-region-catalog.ts","line":29,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/region/infrastructure/catalog/json-region-catalog.ts:29"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"apps/api/src/region/infrastructure/catalog/json-region-catalog.ts","line":29,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:apps/api/src/region/infrastructure/catalog/json-region-catalog.ts:29"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":8342.0,"source_lines":9496.0,"test_ratio":0.8785,"ci_files":0.0,"cochange_share":0.9057,"cochange_commits":53.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":187.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: apps/api/tsconfig.json","ref":"apps/api/tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":9496.0,"other_lines":0.0,"files_blamed":202.0,"blame_failures":0.0,"quality:ai_findings":16.0,"quality:ai_per_kloc":1.685,"quality:other_findings":0.0,"security:ai_findings":4.0,"security:ai_per_kloc":0.421,"security:other_findings":0.0},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}