{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T16:27:11.064598Z","repo":{"ref":{"host":"github.com","owner":"MHSanaei","name":"3x-ui"},"default_branch":"main","clone_url":"https://github.com/MHSanaei/3x-ui.git","html_url":"https://github.com/MHSanaei/3x-ui","description":"Supporting multi-protocol multi-user(Vmess, Vless, Trojan, ShadowSocks, Wireguard, Hysteria, Tunnel, Mixed, HTTP, Tun, MTProto، AmneziaWG) ","stars":49902,"forks":12759,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":80786,"primary_language":"Go","license_spdx":"GPL-3.0","created_at":"2023-02-09T19:16:57Z","pushed_at":"2026-11-13T18:59:34Z","security_policy_url":"https://github.com/MHSanaei/3x-ui/security/policy","distribution":{"owner_created_at":"2017-11-07T12:49:09Z","owner_type":"User","release_assets":[{"name":"x-ui-linux-386.tar.gz","size":84303654,"download_count":8,"release_tag":"dev-latest","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-linux-386.tar.gz"},{"name":"x-ui-linux-386.tar.gz.sha256","size":88,"download_count":2,"release_tag":"dev-latest","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-linux-386.tar.gz.sha256"},{"name":"x-ui-linux-amd64.tar.gz","size":86479907,"download_count":323,"release_tag":"dev-latest","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-linux-amd64.tar.gz"},{"name":"x-ui-linux-amd64.tar.gz.sha256","size":90,"download_count":306,"release_tag":"dev-latest","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-linux-amd64.tar.gz.sha256"},{"name":"x-ui-linux-arm64.tar.gz","size":81815290,"download_count":14,"release_tag":"dev-latest","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-linux-arm64.tar.gz"},{"name":"x-ui-linux-arm64.tar.gz.sha256","size":90,"download_count":7,"release_tag":"dev-latest","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-linux-arm64.tar.gz.sha256"},{"name":"x-ui-linux-armv5.tar.gz","size":78802319,"download_count":10,"release_tag":"dev-latest","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-linux-armv5.tar.gz"},{"name":"x-ui-linux-armv5.tar.gz.sha256","size":90,"download_count":2,"release_tag":"dev-latest","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-linux-armv5.tar.gz.sha256"},{"name":"x-ui-linux-armv6.tar.gz","size":84153124,"download_count":7,"release_tag":"dev-latest","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-linux-armv6.tar.gz"},{"name":"x-ui-linux-armv6.tar.gz.sha256","size":90,"download_count":2,"release_tag":"dev-latest","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-linux-armv6.tar.gz.sha256"},{"name":"x-ui-linux-armv7.tar.gz","size":84094548,"download_count":7,"release_tag":"dev-latest","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-linux-armv7.tar.gz"},{"name":"x-ui-linux-armv7.tar.gz.sha256","size":90,"download_count":2,"release_tag":"dev-latest","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-linux-armv7.tar.gz.sha256"},{"name":"x-ui-linux-s390x.tar.gz","size":80184805,"download_count":8,"release_tag":"dev-latest","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-linux-s390x.tar.gz"},{"name":"x-ui-linux-s390x.tar.gz.sha256","size":90,"download_count":2,"release_tag":"dev-latest","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-linux-s390x.tar.gz.sha256"},{"name":"x-ui-windows-amd64.zip","size":94708648,"download_count":10,"release_tag":"dev-latest","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-windows-amd64.zip"},{"name":"x-ui-windows-amd64.zip.sha256","size":89,"download_count":3,"release_tag":"dev-latest","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-windows-amd64.zip.sha256"},{"name":"x-ui-linux-386.tar.gz","size":80547595,"download_count":366,"release_tag":"v3.11.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.11.0/x-ui-linux-386.tar.gz"},{"name":"x-ui-linux-386.tar.gz.sha256","size":88,"download_count":157,"release_tag":"v3.11.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.11.0/x-ui-linux-386.tar.gz.sha256"},{"name":"x-ui-linux-amd64.tar.gz","size":82728788,"download_count":269030,"release_tag":"v3.11.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.11.0/x-ui-linux-amd64.tar.gz"},{"name":"x-ui-linux-amd64.tar.gz.sha256","size":90,"download_count":250137,"release_tag":"v3.11.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.11.0/x-ui-linux-amd64.tar.gz.sha256"},{"name":"x-ui-linux-arm64.tar.gz","size":78161793,"download_count":7780,"release_tag":"v3.11.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.11.0/x-ui-linux-arm64.tar.gz"},{"name":"x-ui-linux-arm64.tar.gz.sha256","size":90,"download_count":6283,"release_tag":"v3.11.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.11.0/x-ui-linux-arm64.tar.gz.sha256"},{"name":"x-ui-linux-armv5.tar.gz","size":75082187,"download_count":906,"release_tag":"v3.11.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.11.0/x-ui-linux-armv5.tar.gz"},{"name":"x-ui-linux-armv5.tar.gz.sha256","size":90,"download_count":875,"release_tag":"v3.11.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.11.0/x-ui-linux-armv5.tar.gz.sha256"},{"name":"x-ui-linux-armv6.tar.gz","size":80429512,"download_count":919,"release_tag":"v3.11.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.11.0/x-ui-linux-armv6.tar.gz"},{"name":"x-ui-linux-armv6.tar.gz.sha256","size":90,"download_count":878,"release_tag":"v3.11.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.11.0/x-ui-linux-armv6.tar.gz.sha256"},{"name":"x-ui-linux-armv7.tar.gz","size":80355815,"download_count":1060,"release_tag":"v3.11.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.11.0/x-ui-linux-armv7.tar.gz"},{"name":"x-ui-linux-armv7.tar.gz.sha256","size":90,"download_count":956,"release_tag":"v3.11.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.11.0/x-ui-linux-armv7.tar.gz.sha256"},{"name":"x-ui-linux-s390x.tar.gz","size":76444624,"download_count":148,"release_tag":"v3.11.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.11.0/x-ui-linux-s390x.tar.gz"},{"name":"x-ui-linux-s390x.tar.gz.sha256","size":90,"download_count":106,"release_tag":"v3.11.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.11.0/x-ui-linux-s390x.tar.gz.sha256"},{"name":"x-ui-windows-amd64.zip","size":90834585,"download_count":1766,"release_tag":"v3.11.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.11.0/x-ui-windows-amd64.zip"},{"name":"x-ui-windows-amd64.zip.sha256","size":89,"download_count":292,"release_tag":"v3.11.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.11.0/x-ui-windows-amd64.zip.sha256"},{"name":"x-ui-linux-386.tar.gz","size":81218748,"download_count":295,"release_tag":"v3.10.2","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.2/x-ui-linux-386.tar.gz"},{"name":"x-ui-linux-386.tar.gz.sha256","size":88,"download_count":116,"release_tag":"v3.10.2","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.2/x-ui-linux-386.tar.gz.sha256"},{"name":"x-ui-linux-amd64.tar.gz","size":83534439,"download_count":129712,"release_tag":"v3.10.2","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.2/x-ui-linux-amd64.tar.gz"},{"name":"x-ui-linux-amd64.tar.gz.sha256","size":90,"download_count":119210,"release_tag":"v3.10.2","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.2/x-ui-linux-amd64.tar.gz.sha256"},{"name":"x-ui-linux-arm64.tar.gz","size":78890443,"download_count":4871,"release_tag":"v3.10.2","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.2/x-ui-linux-arm64.tar.gz"},{"name":"x-ui-linux-arm64.tar.gz.sha256","size":90,"download_count":4229,"release_tag":"v3.10.2","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.2/x-ui-linux-arm64.tar.gz.sha256"},{"name":"x-ui-linux-armv5.tar.gz","size":75730509,"download_count":373,"release_tag":"v3.10.2","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.2/x-ui-linux-armv5.tar.gz"},{"name":"x-ui-linux-armv5.tar.gz.sha256","size":90,"download_count":325,"release_tag":"v3.10.2","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.2/x-ui-linux-armv5.tar.gz.sha256"},{"name":"x-ui-linux-armv6.tar.gz","size":81075659,"download_count":377,"release_tag":"v3.10.2","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.2/x-ui-linux-armv6.tar.gz"},{"name":"x-ui-linux-armv6.tar.gz.sha256","size":90,"download_count":336,"release_tag":"v3.10.2","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.2/x-ui-linux-armv6.tar.gz.sha256"},{"name":"x-ui-linux-armv7.tar.gz","size":81011479,"download_count":458,"release_tag":"v3.10.2","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.2/x-ui-linux-armv7.tar.gz"},{"name":"x-ui-linux-armv7.tar.gz.sha256","size":90,"download_count":361,"release_tag":"v3.10.2","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.2/x-ui-linux-armv7.tar.gz.sha256"},{"name":"x-ui-linux-s390x.tar.gz","size":77200095,"download_count":134,"release_tag":"v3.10.2","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.2/x-ui-linux-s390x.tar.gz"},{"name":"x-ui-linux-s390x.tar.gz.sha256","size":90,"download_count":108,"release_tag":"v3.10.2","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.2/x-ui-linux-s390x.tar.gz.sha256"},{"name":"x-ui-windows-amd64.zip","size":91570295,"download_count":1362,"release_tag":"v3.10.2","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.2/x-ui-windows-amd64.zip"},{"name":"x-ui-windows-amd64.zip.sha256","size":89,"download_count":182,"release_tag":"v3.10.2","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.2/x-ui-windows-amd64.zip.sha256"},{"name":"x-ui-linux-386.tar.gz","size":80833805,"download_count":87,"release_tag":"v3.10.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.0/x-ui-linux-386.tar.gz"},{"name":"x-ui-linux-386.tar.gz.sha256","size":88,"download_count":47,"release_tag":"v3.10.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.0/x-ui-linux-386.tar.gz.sha256"},{"name":"x-ui-linux-amd64.tar.gz","size":83157166,"download_count":29758,"release_tag":"v3.10.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.0/x-ui-linux-amd64.tar.gz"},{"name":"x-ui-linux-amd64.tar.gz.sha256","size":90,"download_count":28124,"release_tag":"v3.10.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.0/x-ui-linux-amd64.tar.gz.sha256"},{"name":"x-ui-linux-arm64.tar.gz","size":78565160,"download_count":1279,"release_tag":"v3.10.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.0/x-ui-linux-arm64.tar.gz"},{"name":"x-ui-linux-arm64.tar.gz.sha256","size":90,"download_count":1067,"release_tag":"v3.10.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.0/x-ui-linux-arm64.tar.gz.sha256"},{"name":"x-ui-linux-armv5.tar.gz","size":75701789,"download_count":286,"release_tag":"v3.10.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.0/x-ui-linux-armv5.tar.gz"},{"name":"x-ui-linux-armv5.tar.gz.sha256","size":90,"download_count":270,"release_tag":"v3.10.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.0/x-ui-linux-armv5.tar.gz.sha256"},{"name":"x-ui-linux-armv6.tar.gz","size":80694075,"download_count":290,"release_tag":"v3.10.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.0/x-ui-linux-armv6.tar.gz"},{"name":"x-ui-linux-armv6.tar.gz.sha256","size":90,"download_count":271,"release_tag":"v3.10.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.0/x-ui-linux-armv6.tar.gz.sha256"},{"name":"x-ui-linux-armv7.tar.gz","size":80626156,"download_count":330,"release_tag":"v3.10.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.0/x-ui-linux-armv7.tar.gz"},{"name":"x-ui-linux-armv7.tar.gz.sha256","size":90,"download_count":290,"release_tag":"v3.10.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.0/x-ui-linux-armv7.tar.gz.sha256"},{"name":"x-ui-linux-s390x.tar.gz","size":77168231,"download_count":58,"release_tag":"v3.10.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.0/x-ui-linux-s390x.tar.gz"},{"name":"x-ui-linux-s390x.tar.gz.sha256","size":90,"download_count":39,"release_tag":"v3.10.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.0/x-ui-linux-s390x.tar.gz.sha256"},{"name":"x-ui-windows-amd64.zip","size":91090473,"download_count":292,"release_tag":"v3.10.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.0/x-ui-windows-amd64.zip"},{"name":"x-ui-windows-amd64.zip.sha256","size":89,"download_count":56,"release_tag":"v3.10.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.10.0/x-ui-windows-amd64.zip.sha256"},{"name":"x-ui-linux-386.tar.gz","size":79608233,"download_count":196,"release_tag":"v3.9.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.9.0/x-ui-linux-386.tar.gz"},{"name":"x-ui-linux-386.tar.gz.sha256","size":88,"download_count":102,"release_tag":"v3.9.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.9.0/x-ui-linux-386.tar.gz.sha256"},{"name":"x-ui-linux-amd64.tar.gz","size":81815383,"download_count":117248,"release_tag":"v3.9.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.9.0/x-ui-linux-amd64.tar.gz"},{"name":"x-ui-linux-amd64.tar.gz.sha256","size":90,"download_count":110063,"release_tag":"v3.9.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.9.0/x-ui-linux-amd64.tar.gz.sha256"},{"name":"x-ui-linux-arm64.tar.gz","size":77368787,"download_count":3702,"release_tag":"v3.9.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.9.0/x-ui-linux-arm64.tar.gz"},{"name":"x-ui-linux-arm64.tar.gz.sha256","size":90,"download_count":3399,"release_tag":"v3.9.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.9.0/x-ui-linux-arm64.tar.gz.sha256"},{"name":"x-ui-linux-armv5.tar.gz","size":74430502,"download_count":120,"release_tag":"v3.9.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.9.0/x-ui-linux-armv5.tar.gz"},{"name":"x-ui-linux-armv5.tar.gz.sha256","size":90,"download_count":95,"release_tag":"v3.9.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.9.0/x-ui-linux-armv5.tar.gz.sha256"},{"name":"x-ui-linux-armv6.tar.gz","size":79425098,"download_count":122,"release_tag":"v3.9.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.9.0/x-ui-linux-armv6.tar.gz"},{"name":"x-ui-linux-armv6.tar.gz.sha256","size":90,"download_count":93,"release_tag":"v3.9.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.9.0/x-ui-linux-armv6.tar.gz.sha256"},{"name":"x-ui-linux-armv7.tar.gz","size":79355467,"download_count":208,"release_tag":"v3.9.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.9.0/x-ui-linux-armv7.tar.gz"},{"name":"x-ui-linux-armv7.tar.gz.sha256","size":90,"download_count":140,"release_tag":"v3.9.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.9.0/x-ui-linux-armv7.tar.gz.sha256"},{"name":"x-ui-linux-s390x.tar.gz","size":75837539,"download_count":113,"release_tag":"v3.9.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.9.0/x-ui-linux-s390x.tar.gz"},{"name":"x-ui-linux-s390x.tar.gz.sha256","size":90,"download_count":88,"release_tag":"v3.9.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.9.0/x-ui-linux-s390x.tar.gz.sha256"},{"name":"x-ui-windows-amd64.zip","size":89713784,"download_count":873,"release_tag":"v3.9.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.9.0/x-ui-windows-amd64.zip"},{"name":"x-ui-windows-amd64.zip.sha256","size":89,"download_count":153,"release_tag":"v3.9.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.9.0/x-ui-windows-amd64.zip.sha256"},{"name":"x-ui-linux-386.tar.gz","size":80142322,"download_count":340,"release_tag":"v3.8.5","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.5/x-ui-linux-386.tar.gz"},{"name":"x-ui-linux-386.tar.gz.sha256","size":88,"download_count":145,"release_tag":"v3.8.5","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.5/x-ui-linux-386.tar.gz.sha256"},{"name":"x-ui-linux-amd64.tar.gz","size":82364650,"download_count":197937,"release_tag":"v3.8.5","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.5/x-ui-linux-amd64.tar.gz"},{"name":"x-ui-linux-amd64.tar.gz.sha256","size":90,"download_count":183769,"release_tag":"v3.8.5","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.5/x-ui-linux-amd64.tar.gz.sha256"},{"name":"x-ui-linux-arm64.tar.gz","size":77904750,"download_count":5697,"release_tag":"v3.8.5","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.5/x-ui-linux-arm64.tar.gz"},{"name":"x-ui-linux-arm64.tar.gz.sha256","size":90,"download_count":5069,"release_tag":"v3.8.5","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.5/x-ui-linux-arm64.tar.gz.sha256"},{"name":"x-ui-linux-armv5.tar.gz","size":73927683,"download_count":162,"release_tag":"v3.8.5","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.5/x-ui-linux-armv5.tar.gz"},{"name":"x-ui-linux-armv5.tar.gz.sha256","size":90,"download_count":130,"release_tag":"v3.8.5","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.5/x-ui-linux-armv5.tar.gz.sha256"},{"name":"x-ui-linux-armv6.tar.gz","size":78916167,"download_count":161,"release_tag":"v3.8.5","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.5/x-ui-linux-armv6.tar.gz"},{"name":"x-ui-linux-armv6.tar.gz.sha256","size":90,"download_count":134,"release_tag":"v3.8.5","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.5/x-ui-linux-armv6.tar.gz.sha256"},{"name":"x-ui-linux-armv7.tar.gz","size":79785549,"download_count":306,"release_tag":"v3.8.5","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.5/x-ui-linux-armv7.tar.gz"},{"name":"x-ui-linux-armv7.tar.gz.sha256","size":90,"download_count":183,"release_tag":"v3.8.5","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.5/x-ui-linux-armv7.tar.gz.sha256"},{"name":"x-ui-linux-s390x.tar.gz","size":75290633,"download_count":162,"release_tag":"v3.8.5","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.5/x-ui-linux-s390x.tar.gz"},{"name":"x-ui-linux-s390x.tar.gz.sha256","size":90,"download_count":123,"release_tag":"v3.8.5","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.5/x-ui-linux-s390x.tar.gz.sha256"},{"name":"x-ui-windows-amd64.zip","size":90064764,"download_count":1485,"release_tag":"v3.8.5","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.5/x-ui-windows-amd64.zip"},{"name":"x-ui-windows-amd64.zip.sha256","size":89,"download_count":243,"release_tag":"v3.8.5","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.5/x-ui-windows-amd64.zip.sha256"},{"name":"x-ui-linux-386.tar.gz","size":80076356,"download_count":94,"release_tag":"v3.8.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.0/x-ui-linux-386.tar.gz"},{"name":"x-ui-linux-386.tar.gz.sha256","size":88,"download_count":54,"release_tag":"v3.8.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.0/x-ui-linux-386.tar.gz.sha256"},{"name":"x-ui-linux-amd64.tar.gz","size":82291492,"download_count":19386,"release_tag":"v3.8.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.0/x-ui-linux-amd64.tar.gz"},{"name":"x-ui-linux-amd64.tar.gz.sha256","size":90,"download_count":18386,"release_tag":"v3.8.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.0/x-ui-linux-amd64.tar.gz.sha256"},{"name":"x-ui-linux-arm64.tar.gz","size":77840635,"download_count":892,"release_tag":"v3.8.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.0/x-ui-linux-arm64.tar.gz"},{"name":"x-ui-linux-arm64.tar.gz.sha256","size":90,"download_count":790,"release_tag":"v3.8.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.0/x-ui-linux-arm64.tar.gz.sha256"},{"name":"x-ui-linux-armv5.tar.gz","size":73869236,"download_count":110,"release_tag":"v3.8.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.0/x-ui-linux-armv5.tar.gz"},{"name":"x-ui-linux-armv5.tar.gz.sha256","size":90,"download_count":49,"release_tag":"v3.8.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.0/x-ui-linux-armv5.tar.gz.sha256"},{"name":"x-ui-linux-armv6.tar.gz","size":78852822,"download_count":82,"release_tag":"v3.8.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.0/x-ui-linux-armv6.tar.gz"},{"name":"x-ui-linux-armv6.tar.gz.sha256","size":90,"download_count":49,"release_tag":"v3.8.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.0/x-ui-linux-armv6.tar.gz.sha256"},{"name":"x-ui-linux-armv7.tar.gz","size":79714926,"download_count":105,"release_tag":"v3.8.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.0/x-ui-linux-armv7.tar.gz"},{"name":"x-ui-linux-armv7.tar.gz.sha256","size":90,"download_count":59,"release_tag":"v3.8.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.0/x-ui-linux-armv7.tar.gz.sha256"},{"name":"x-ui-linux-s390x.tar.gz","size":75223808,"download_count":81,"release_tag":"v3.8.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.0/x-ui-linux-s390x.tar.gz"},{"name":"x-ui-linux-s390x.tar.gz.sha256","size":90,"download_count":47,"release_tag":"v3.8.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.0/x-ui-linux-s390x.tar.gz.sha256"},{"name":"x-ui-windows-amd64.zip","size":89991540,"download_count":259,"release_tag":"v3.8.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.0/x-ui-windows-amd64.zip"},{"name":"x-ui-windows-amd64.zip.sha256","size":89,"download_count":57,"release_tag":"v3.8.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.8.0/x-ui-windows-amd64.zip.sha256"},{"name":"x-ui-linux-386.tar.gz","size":78060257,"download_count":291,"release_tag":"v3.7.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.7.0/x-ui-linux-386.tar.gz"},{"name":"x-ui-linux-amd64.tar.gz","size":80280886,"download_count":222579,"release_tag":"v3.7.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.7.0/x-ui-linux-amd64.tar.gz"},{"name":"x-ui-linux-arm64.tar.gz","size":76020042,"download_count":6680,"release_tag":"v3.7.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.7.0/x-ui-linux-arm64.tar.gz"},{"name":"x-ui-linux-armv5.tar.gz","size":72940655,"download_count":190,"release_tag":"v3.7.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.7.0/x-ui-linux-armv5.tar.gz"},{"name":"x-ui-linux-armv6.tar.gz","size":77918407,"download_count":183,"release_tag":"v3.7.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.7.0/x-ui-linux-armv6.tar.gz"},{"name":"x-ui-linux-armv7.tar.gz","size":77859340,"download_count":293,"release_tag":"v3.7.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.7.0/x-ui-linux-armv7.tar.gz"},{"name":"x-ui-linux-s390x.tar.gz","size":74400306,"download_count":196,"release_tag":"v3.7.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.7.0/x-ui-linux-s390x.tar.gz"},{"name":"x-ui-windows-amd64.zip","size":88109827,"download_count":1979,"release_tag":"v3.7.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.7.0/x-ui-windows-amd64.zip"},{"name":"x-ui-linux-386.tar.gz","size":77303735,"download_count":339,"release_tag":"v3.6.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.6.0/x-ui-linux-386.tar.gz"},{"name":"x-ui-linux-amd64.tar.gz","size":79509316,"download_count":259037,"release_tag":"v3.6.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.6.0/x-ui-linux-amd64.tar.gz"},{"name":"x-ui-linux-arm64.tar.gz","size":75341077,"download_count":6962,"release_tag":"v3.6.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.6.0/x-ui-linux-arm64.tar.gz"},{"name":"x-ui-linux-armv5.tar.gz","size":72143402,"download_count":193,"release_tag":"v3.6.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.6.0/x-ui-linux-armv5.tar.gz"},{"name":"x-ui-linux-armv6.tar.gz","size":77126969,"download_count":192,"release_tag":"v3.6.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.6.0/x-ui-linux-armv6.tar.gz"},{"name":"x-ui-linux-armv7.tar.gz","size":77064100,"download_count":335,"release_tag":"v3.6.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.6.0/x-ui-linux-armv7.tar.gz"},{"name":"x-ui-linux-s390x.tar.gz","size":73695999,"download_count":198,"release_tag":"v3.6.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.6.0/x-ui-linux-s390x.tar.gz"},{"name":"x-ui-windows-amd64.zip","size":87340320,"download_count":1979,"release_tag":"v3.6.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.6.0/x-ui-windows-amd64.zip"},{"name":"x-ui-linux-386.tar.gz","size":81194293,"download_count":329,"release_tag":"v3.5.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.5.0/x-ui-linux-386.tar.gz"},{"name":"x-ui-linux-amd64.tar.gz","size":83398797,"download_count":186420,"release_tag":"v3.5.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.5.0/x-ui-linux-amd64.tar.gz"},{"name":"x-ui-linux-arm64.tar.gz","size":79236542,"download_count":5038,"release_tag":"v3.5.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.5.0/x-ui-linux-arm64.tar.gz"},{"name":"x-ui-linux-armv5.tar.gz","size":76029565,"download_count":196,"release_tag":"v3.5.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.5.0/x-ui-linux-armv5.tar.gz"},{"name":"x-ui-linux-armv6.tar.gz","size":81016865,"download_count":205,"release_tag":"v3.5.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.5.0/x-ui-linux-armv6.tar.gz"},{"name":"x-ui-linux-armv7.tar.gz","size":80963625,"download_count":295,"release_tag":"v3.5.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.5.0/x-ui-linux-armv7.tar.gz"},{"name":"x-ui-linux-s390x.tar.gz","size":77584419,"download_count":196,"release_tag":"v3.5.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.5.0/x-ui-linux-s390x.tar.gz"},{"name":"x-ui-windows-amd64.zip","size":91187395,"download_count":1266,"release_tag":"v3.5.0","url":"https://github.com/MHSanaei/3x-ui/releases/download/v3.5.0/x-ui-windows-amd64.zip"}]}},"commit_sha":"5297fd3c8495d80fab97ae511553fa545c69e913","profile":{"lines_by_language":{"Go":238113,"TypeScript":114030,"Shell":7302,"JavaScript":1124},"files_by_category":{"source":921,"test":890,"other":262,"config":161,"binary":53,"docs":33,"generated":7,"oversized":1},"source_lines":201803,"test_lines":158766},"pillars":{"ai_provenance":{"score":12.4,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.1236,"suspected_share":0.1421,"estimated_share":0.1236,"ai_artifacts":4.0,"flagged_work_units":13.0,"flagged_releases":2.0,"style_index":0.149},"summary":"Explicit AI attribution on 12% of first-party code added; an estimated 12% including velocity signals."},"quality":{"score":76.1,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":41.2,"duplication":62.9,"lint":85.1,"testing":100.0,"docs":80.0,"type_safety":100.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.79, CI runs tests; 30% of function code in complex or long functions; 8% duplicated lines. Weakest area: complexity."},"security":{"score":45.0,"confidence":0.85,"coverage":1.0,"label":"poor","breakdown":{"secrets":2.3,"sast":92.7,"dependencies":56.7,"ci_actions":0.0,"posture":100.0,"scorecard":null},"summary":"Security posture is poor: 2 possible secret(s) in the tree, 4 only in history; 12 known vulnerabilities in 4 dependencies; 23 high-severity SAST findings; 80 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":62.0,"checked":62.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":3888.0,"attributed_commits":106.0,"attributed_commit_share":0.02726337448559671,"effective_loc":684744.0,"attributed_loc":84612.0,"attributed_loc_share":0.12356734779713294,"tools_detected":4.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 74 attributed commits, 71,000 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"OpenAI Codex: 23 attributed commits, 12,253 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"GitHub Copilot coding agent: 8 attributed commits, 761 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Cursor agent: 1 attributed commits, 598 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/dns-draggable-ordering-da6918'","ref":"51f7ba47f78d6c48d637dceb9b1bb7febe474cbe","url":"https://github.com/MHSanaei/3x-ui/commit/51f7ba47f78d6c48d637dceb9b1bb7febe474cbe","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/issue-7023-inbound-a11y'","ref":"f4030c889c2ea3f6aab492774b7b9d70eb311ad0","url":"https://github.com/MHSanaei/3x-ui/commit/f4030c889c2ea3f6aab492774b7b9d70eb311ad0","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-telegram-command-screens'","ref":"e093854f5b49937321adcd3e0f84a965291144b5","url":"https://github.com/MHSanaei/3x-ui/commit/e093854f5b49937321adcd3e0f84a965291144b5","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-node-client-lifecycle'","ref":"81059edc91f40f3f5ed99ae4e3f7b2a8e303ff81","url":"https://github.com/MHSanaei/3x-ui/commit/81059edc91f40f3f5ed99ae4e3f7b2a8e303ff81","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/unruffled-sinoussi-682e7e'","ref":"6d9e836d615631bce208b62c02317013fb840339","url":"https://github.com/MHSanaei/3x-ui/commit/6d9e836d615631bce208b62c02317013fb840339","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-telegram-menu-media'","ref":"4d583cebf3b4826fd66f5fa6dc45462278dbace8","url":"https://github.com/MHSanaei/3x-ui/commit/4d583cebf3b4826fd66f5fa6dc45462278dbace8","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/issue-6993-keep-host-settings'","ref":"d2450e103c2b543a78f909705e573bfc7ebb1867","url":"https://github.com/MHSanaei/3x-ui/commit/d2450e103c2b543a78f909705e573bfc7ebb1867","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/fix-hysteria2-external-clash'","ref":"34a762f7c8d18ae2c8026f4311f1cdc9e08aa648","url":"https://github.com/MHSanaei/3x-ui/commit/34a762f7c8d18ae2c8026f4311f1cdc9e08aa648","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/3x-ui-xray-balancer-i18n-cb0660'","ref":"05199dda00035c3c95b60f005e68447ab08fe249","url":"https://github.com/MHSanaei/3x-ui/commit/05199dda00035c3c95b60f005e68447ab08fe249","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/awg-kernel-upstream'","ref":"56ac8d0fc7c5df9c3bc84cc933967a1a493521bc","url":"https://github.com/MHSanaei/3x-ui/commit/56ac8d0fc7c5df9c3bc84cc933967a1a493521bc","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/awg-keepalive-range'","ref":"35e09191de51e61d7f724dbdbe3a2dfbb3b7371e","url":"https://github.com/MHSanaei/3x-ui/commit/35e09191de51e61d7f724dbdbe3a2dfbb3b7371e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"a403faee239e0454f8bcc2f825e18309dc57f0e7","url":"https://github.com/MHSanaei/3x-ui/commit/a403faee239e0454f8bcc2f825e18309dc57f0e7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR description attribution","ref":"ad470681efcc5a048025673a1a794357dd22bb54","url":"https://github.com/MHSanaei/3x-ui/commit/ad470681efcc5a048025673a1a794357dd22bb54","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1edb8b31bc1413ad9ef145d2563361276ebabfe4","url":"https://github.com/MHSanaei/3x-ui/commit/1edb8b31bc1413ad9ef145d2563361276ebabfe4","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: trailer 'Co-authored-by: Copilot'","ref":"c321933a548360124b2f48f6a0feee020b9119cc","url":"https://github.com/MHSanaei/3x-ui/commit/c321933a548360124b2f48f6a0feee020b9119cc","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"2c5fc8e72c6d56b42febeab299c7a8414b3a86ff","url":"https://github.com/MHSanaei/3x-ui/commit/2c5fc8e72c6d56b42febeab299c7a8414b3a86ff","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: PR branch 'claude/6733-fix'","ref":"d4a7086c4e92b12303f82ea0c4dc02ef8c19a311","url":"https://github.com/MHSanaei/3x-ui/commit/d4a7086c4e92b12303f82ea0c4dc02ef8c19a311","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/client-calendar-weekly-renewal'","ref":"9672249edb4875ce3fb470dfc046e1e3cd9c2f96","url":"https://github.com/MHSanaei/3x-ui/commit/9672249edb4875ce3fb470dfc046e1e3cd9c2f96","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"788b76c5441c166a6a9982dbb4657ecfd93f434c","url":"https://github.com/MHSanaei/3x-ui/commit/788b76c5441c166a6a9982dbb4657ecfd93f434c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"6ac0c88084d06d5eef816178dddae8618b552655","url":"https://github.com/MHSanaei/3x-ui/commit/6ac0c88084d06d5eef816178dddae8618b552655","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"6ab718f8134d1445fe05e2e26663fc29a6b45d30","url":"https://github.com/MHSanaei/3x-ui/commit/6ab718f8134d1445fe05e2e26663fc29a6b45d30","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"8979072bd9b9132f5b8e346c77ba0bae0dff5626","url":"https://github.com/MHSanaei/3x-ui/commit/8979072bd9b9132f5b8e346c77ba0bae0dff5626","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/pr-6572-verified'","ref":"5d41e65a3c4e5f1a795a836903d6cf8d8c443bbe","url":"https://github.com/MHSanaei/3x-ui/commit/5d41e65a3c4e5f1a795a836903d6cf8d8c443bbe","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/calendar-expiry-presentation'","ref":"c90996eda34146668dfc379c2b5637f097e51d9d","url":"https://github.com/MHSanaei/3x-ui/commit/c90996eda34146668dfc379c2b5637f097e51d9d","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/mihomo-reality-mlkem'","ref":"0a2cd789ba11a617a910f7c4d1bdbf30883aef39","url":"https://github.com/MHSanaei/3x-ui/commit/0a2cd789ba11a617a910f7c4d1bdbf30883aef39","weight":0.9}],"data":{"attributed_loc_by_commit":{"40b6d7707a8d7856eb97e00ea7c86052859ce162":8,"9623e875113adad1fcbae7370e043db040462f2a":115,"83a1c721c761b82c719a51870e78f24d50f3a028":5,"5bb87fd3d4142d606c3875641d7ca68aa8f1a5c4":22,"d580086361036f87af843d0f7386bdc54736720a":496,"3349dcbc137ba550657344522dab9b5bb31982e8":73,"79a7e7a5b5c1590c4997c08540cbce12e2bf272d":80,"3b64a62137191395aa995b5bd5f857999dd1eed2":0,"42b2ebc00bd956c76b5db4530765eeede3a2bf02":336,"39bf31bd56410802ded15483ec143d31408ccd46":6,"28a3dddb605f86cb45006ced27a99e11c638a1cf":26,"59c55dfc9267e56a1f6388481916f6a6bd78c97b":0,"b84b58ef218894873f6cabd8ee34dcad3c1e714d":16,"c394938f01b59200481a8871557a2608b6f09b44":133,"7f703f927ec26f77d91225b56efc76c2023cd64f":99,"d8198f543b243b7b7f04d2278f503a2c2790b1e6":118,"2fd2cd0af17090ee5c2f37e5c10080a94b8ef1c7":10,"12c10dbd98f6d3c3be8b79bdcf52542b4cda87db":0,"bc00d37ad81d8072c9a2692e42884b5f5edd6ee0":23216,"b885a1f8a6575d3acd99ccc3a7c7adb0e1baa1f1":90,"61c84e8223a6a27957c86bbef3d57b587387426b":162,"f70e131dfea9d5b6bd89c5821332ea55091c06cc":12,"444b05cac901ca2bd94013ceefc683095726e2d9":14,"81b4ae5661b1d3c934169f7ffb764f0b3912ab4d":4,"dee2525d5f6c3e717ecfc41855a91eb0dcd3d80b":12,"24cd271486cf9fbdce49a871d29935d2db473954":4,"8e7d215b4a41f2ee79d918adf63a73eaa9180fa7":543,"a96612f595898b83b5ba01882a2a133bbff20c31":994,"85e2ded0e1f5173e6b97c1fb1df937baf3bc2ce6":10836,"16edb037e7b61a5ce91367b8095d955bfc7a4fee":13,"12d84c2a46597047ff133a1986f83fe06fe123a4":8,"d6d2085d60370b4eabebce78fc7a1be3e0d6cb5e":50,"6ed6f57b5ce0548c4bb857fd68055ed6f3ceddcf":598,"ffde2f7ebf0f022dd4260dd150a462a524733547":19,"dab0add191a17a54a2018d3028a649edfa4d6a70":238,"628406117e344838c1c0cb3a3157e5f24295a2c9":173,"2392f04e0271ebe15e34de9debe9a68cdf0fba2f":3,"a0f4c13dc5a79d08863fbbbe90f4e9789abb52ec":6,"b07fad0e697bdcf808edd31930efb42ff0eb99b7":0,"fea3c94b111a3e31bb6406b941bc2f60beffe19e":427,"14de0557f90240db99cc712483d1d5cb31224525":353,"82600936d6bb59da3aeeada78c14b727ad0b1212":337,"42690e1b8c69ac64e3919dd2cf42ead777d63c5f":1303,"f3e99058f9a6976144faac9f682fd0eddcfba721":13,"5e1cb7693b0a7541bfcf1eca5c66f639193e5715":2719,"9e117bbdd3f7724a5a95f9a0c569237ee86a284f":77,"2b1308ca299e19f0df1b6042601a1dbfb1cfb9b6":235,"892c06c8bc869a4053bfdfdb4806cb65d318e487":1165,"579acbc66969e59eccc05ec81b383597fac70bbd":33,"604986598f22fcf99fc73c4c39e78ac4d2be7594":45,"48675ff197a27b9f4a447a36d16e243df5761859":0,"a2774bf21237c79dc46b0122636bb47e41eb6123":3,"411271b4545f4d80513b3d4e7038fed30bdf473b":108,"ca6955d88b97eaab85c913522938def0e990a08b":145,"ea35884390e2199e196a5b44fda189e385660f9b":91,"33f72f8f4a0938de85f46b5bc05d37ea5e9c86f4":146,"bcd71c929694c7fe056d535ef97bdb29a87eb11f":7,"55f02816924e1284cc810ecf14a5ef46dfcefbff":40,"87ebcc7a6f68f10c8b1d3f330a84105e32519116":342,"69a8237581cb44c9f8ca1454eaee3ef2d5f6fb8d":0,"79ef85b59fa01b7ffcc82a611e6ad5079f031536":0,"64f4f0746c90a2f50cb2d3286c4bae712262656c":122,"4a5f6771b362cec5696a1e027d4c788f29cdc00f":53,"238e4bb31422e6c6754fd77f94a7acfd93ef0a64":62,"286a93474d58510e7bda5371e7e1bcd79cfc4ef5":0,"0a30a03cb754c89a1b5af381abc2975939286634":0,"9165ab67ebf1cb2f1d58535c4c83664da4415179":77,"d05e44e4019bd860ad295b43602bdd0c4e03c8e2":362,"20b3f84f77d933a6e5b31ec13ba857928b2c19bd":130,"b70c5abce8d2180e63ea163975c80a7798eeb846":108,"8c8556ab32152d9fe158fc2b79c129da682dacae":571,"708a69acde493c42c470d22c695e365e9ff86027":199,"da01b7637dc317098e84ef54008fafdb722aaf35":2418,"effcccceac26d9381a116c29279c40d471a3b0cb":13419,"195988bdc138399e91c7acfa6d0d397c3b1e7e94":95,"5a63d5d468ac50e16e5b1dc8db87dc0cf6934e29":719,"9f76a66dcfb44e40777a89b9ad332999bd327964":1235,"876497db6e0facc94bd3c016984b0e55072f6871":584,"d5ab84e8d503785d7f00c43a68c6ab08ef41b10c":4087,"ed5465d0f2f8f83820151fa3c0eb4d4ccf851840":562,"89ee1242bd875192d3b80efbb3202bb727233e3e":358,"0a2cd789ba11a617a910f7c4d1bdbf30883aef39":48,"c90996eda34146668dfc379c2b5637f097e51d9d":345,"5d41e65a3c4e5f1a795a836903d6cf8d8c443bbe":146,"8979072bd9b9132f5b8e346c77ba0bae0dff5626":186,"6ab718f8134d1445fe05e2e26663fc29a6b45d30":81,"6ac0c88084d06d5eef816178dddae8618b552655":29,"788b76c5441c166a6a9982dbb4657ecfd93f434c":34,"9672249edb4875ce3fb470dfc046e1e3cd9c2f96":1934,"d4a7086c4e92b12303f82ea0c4dc02ef8c19a311":81,"2c5fc8e72c6d56b42febeab299c7a8414b3a86ff":284,"c321933a548360124b2f48f6a0feee020b9119cc":8,"1edb8b31bc1413ad9ef145d2563361276ebabfe4":694,"ad470681efcc5a048025673a1a794357dd22bb54":64,"a403faee239e0454f8bcc2f825e18309dc57f0e7":209,"35e09191de51e61d7f724dbdbe3a2dfbb3b7371e":1798,"56ac8d0fc7c5df9c3bc84cc933967a1a493521bc":4568,"05199dda00035c3c95b60f005e68447ab08fe249":13,"34a762f7c8d18ae2c8026f4311f1cdc9e08aa648":237,"d2450e103c2b543a78f909705e573bfc7ebb1867":287,"4d583cebf3b4826fd66f5fa6dc45462278dbace8":447,"6d9e836d615631bce208b62c02317013fb840339":421,"81059edc91f40f3f5ed99ae4e3f7b2a8e303ff81":217,"e093854f5b49937321adcd3e0f84a965291144b5":207,"f4030c889c2ea3f6aab492774b7b9d70eb311ad0":825,"51f7ba47f78d6c48d637dceb9b1bb7febe474cbe":161},"tools":{"github-copilot":{"name":"GitHub Copilot coding agent","commits":8,"loc":761,"first_seen":1757584110,"last_seen":1791795940},"claude-code":{"name":"Claude Code","commits":74,"loc":71000,"first_seen":1776630373,"last_seen":1794587138},"cursor":{"name":"Cursor agent","commits":1,"loc":598,"first_seen":1780706432,"last_seen":1780706432},"openai-codex":{"name":"OpenAI Codex","commits":23,"loc":12253,"first_seen":1785265281,"last_seen":1793898529}},"monthly":{"2023-02":{"loc":57979,"attributed_loc":0},"2023-03":{"loc":1787,"attributed_loc":0},"2023-04":{"loc":3292,"attributed_loc":0},"2023-05":{"loc":3958,"attributed_loc":0},"2023-06":{"loc":1009,"attributed_loc":0},"2023-07":{"loc":1166,"attributed_loc":0},"2023-08":{"loc":434,"attributed_loc":0},"2023-09":{"loc":49,"attributed_loc":0},"2023-10":{"loc":30,"attributed_loc":0},"2023-11":{"loc":296,"attributed_loc":0},"2023-12":{"loc":36215,"attributed_loc":0},"2024-01":{"loc":1950,"attributed_loc":0},"2024-02":{"loc":1005,"attributed_loc":0},"2024-03":{"loc":841,"attributed_loc":0},"2024-04":{"loc":74309,"attributed_loc":0},"2024-05":{"loc":373,"attributed_loc":0},"2024-06":{"loc":498,"attributed_loc":0},"2024-07":{"loc":568,"attributed_loc":0},"2024-08":{"loc":828,"attributed_loc":0},"2024-09":{"loc":467,"attributed_loc":0},"2024-10":{"loc":1056,"attributed_loc":0},"2024-11":{"loc":283,"attributed_loc":0},"2024-12":{"loc":396,"attributed_loc":0},"2025-01":{"loc":540,"attributed_loc":0},"2025-02":{"loc":206,"attributed_loc":0},"2025-03":{"loc":1866,"attributed_loc":0},"2025-04":{"loc":278,"attributed_loc":0},"2025-05":{"loc":692,"attributed_loc":0},"2025-06":{"loc":45,"attributed_loc":0},"2025-07":{"loc":244,"attributed_loc":0},"2025-08":{"loc":912,"attributed_loc":0},"2025-09":{"loc":5252,"attributed_loc":123},"2025-10":{"loc":795,"attributed_loc":0},"2025-11":{"loc":403,"attributed_loc":0},"2025-12":{"loc":1472,"attributed_loc":5},"2026-01":{"loc":2634,"attributed_loc":0},"2026-02":{"loc":1375,"attributed_loc":22},"2026-03":{"loc":105,"attributed_loc":0},"2026-04":{"loc":6614,"attributed_loc":496},"2026-05":{"loc":122219,"attributed_loc":36784},"2026-06":{"loc":85862,"attributed_loc":2225},"2026-07":{"loc":52160,"attributed_loc":6472},"2026-08":{"loc":61492,"attributed_loc":17521},"2026-09":{"loc":69391,"attributed_loc":10443},"2026-10":{"loc":66311,"attributed_loc":7706},"2026-11":{"loc":15087,"attributed_loc":2815}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":2.0,"workflow_agents":2.0,"tools_configured":1.0,"earliest_adoption":1782567731.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"frontend/CLAUDE.md (claude-code configuration)","ref":"frontend/CLAUDE.md","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/frontend/CLAUDE.md","weight":0.5},{"kind":"ai-workflow","description":".github/workflows/claude-issue-analyst.yml runs anthropics/claude-code-action","ref":".github/workflows/claude-issue-analyst.yml","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/.github/workflows/claude-issue-analyst.yml","weight":0.6},{"kind":"ai-workflow","description":".github/workflows/claude-pr-review.yml runs anthropics/claude-code-action","ref":".github/workflows/claude-pr-review.yml","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/.github/workflows/claude-pr-review.yml","weight":0.6}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1782567731},{"tool":"claude-code","path":"frontend/CLAUDE.md","added_at":1782567731}],"workflows":[{"tool":"claude-code","path":".github/workflows/claude-issue-analyst.yml","action":"anthropics/claude-code-action"},{"tool":"claude-code","path":".github/workflows/claude-pr-review.yml","action":"anthropics/claude-code-action"}],"tools":["claude-code"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"work_units":1708.0,"flagged_units":13.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":421279.0,"flagged_loc":97276.0,"flagged_loc_share":0.2309063589687594,"max_loc_per_hour":25565.065202470832,"median_loc_per_hour":37.42454728370221,"pr_timed_units":807.0,"excluded_import_loc":213639.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"41,387 lines of first-party code in ~1.6h (25,565 lines/hour, 1 commit session)","ref":"d37dbb7dc81ee5957e72e1173a9aa9ea626240fb","url":"https://github.com/MHSanaei/3x-ui/commit/d37dbb7dc81ee5957e72e1173a9aa9ea626240fb","weight":0.6},{"kind":"velocity-burst","description":"34,981 lines of first-party code in ~4.0h (8,745 lines/hour, 1 commit session)","ref":"c419eadf15630518606ab434387079172070d340","url":"https://github.com/MHSanaei/3x-ui/commit/c419eadf15630518606ab434387079172070d340","weight":0.6},{"kind":"velocity-burst","description":"1,087 lines of first-party code in ~1.1h (989 lines/hour, 1 commit session)","ref":"e642f7324e54c08e95577292830304e133a63c80","url":"https://github.com/MHSanaei/3x-ui/commit/e642f7324e54c08e95577292830304e133a63c80","weight":0.2966793025018954},{"kind":"velocity-burst","description":"1,133 lines of first-party code in ~1.2h (938 lines/hour, PR #5076)","ref":"1ca5924a446d3bafb97e3eeea3074c4e0ee039ee","url":"https://github.com/MHSanaei/3x-ui/commit/1ca5924a446d3bafb97e3eeea3074c4e0ee039ee","weight":0.28142594296228146},{"kind":"velocity-burst","description":"1,240 lines of first-party code in ~1.3h (928 lines/hour, 2 commit session)","ref":"5716ae5987ae38b6fba8a78f3cd61ad1a5383305","url":"https://github.com/MHSanaei/3x-ui/commit/5716ae5987ae38b6fba8a78f3cd61ad1a5383305","weight":0.27830423940149623},{"kind":"velocity-burst","description":"2,197 lines of first-party code in ~3.0h (735 lines/hour, 4 commit session)","ref":"ec0a57fc4f9d06fe330382691e4321cc267f87a8","url":"https://github.com/MHSanaei/3x-ui/commit/ec0a57fc4f9d06fe330382691e4321cc267f87a8","weight":0.22039383243544494},{"kind":"velocity-burst","description":"1,703 lines of first-party code in ~2.3h (728 lines/hour, 8 commit session)","ref":"f1e433e83969e840bbfe4c460d1741d09bfa1137","url":"https://github.com/MHSanaei/3x-ui/commit/f1e433e83969e840bbfe4c460d1741d09bfa1137","weight":0.21846300035633687},{"kind":"velocity-burst","description":"4,033 lines of first-party code in ~5.9h (686 lines/hour, 29 commit session)","ref":"30f17ef5a334fb501c81953710654b93982a3e05","url":"https://github.com/MHSanaei/3x-ui/commit/30f17ef5a334fb501c81953710654b93982a3e05","weight":0.20575558599839386},{"kind":"velocity-burst","description":"1,166 lines of first-party code in ~1.7h (674 lines/hour, 4 commit session)","ref":"d1b60799ecd46616c2c62afc8e166b1480e7bc84","url":"https://github.com/MHSanaei/3x-ui/commit/d1b60799ecd46616c2c62afc8e166b1480e7bc84","weight":0.2021965317919075},{"kind":"velocity-burst","description":"1,596 lines of first-party code in ~2.4h (667 lines/hour, 1 commit session)","ref":"93eda06878b62c5b41632336ff11e161d3e280b9","url":"https://github.com/MHSanaei/3x-ui/commit/93eda06878b62c5b41632336ff11e161d3e280b9","weight":0.20000928289626363},{"kind":"velocity-burst","description":"1,457 lines of first-party code in ~2.4h (608 lines/hour, 1 commit session)","ref":"62423cacd14a7c4675b3718777200a93b14fcbf6","url":"https://github.com/MHSanaei/3x-ui/commit/62423cacd14a7c4675b3718777200a93b14fcbf6","weight":0.18235716769034652},{"kind":"velocity-burst","description":"3,032 lines of first-party code in ~5.6h (544 lines/hour, 27 commit session)","ref":"469758837a768db19e1d5c325a37c1fbd377ad5b","url":"https://github.com/MHSanaei/3x-ui/commit/469758837a768db19e1d5c325a37c1fbd377ad5b","weight":0.16321387628968748},{"kind":"velocity-burst","description":"2,264 lines of first-party code in ~4.4h (511 lines/hour, PR #5345)","ref":"760590232494c69329cd98832a09d6dd51def1d4","url":"https://github.com/MHSanaei/3x-ui/commit/760590232494c69329cd98832a09d6dd51def1d4","weight":0.15339523212045167}],"data":{"flagged_loc_by_commit":{"d37dbb7dc81ee5957e72e1173a9aa9ea626240fb":41387,"e642f7324e54c08e95577292830304e133a63c80":1087,"3675f88caf92c06e788af5fba46a2989cb6ceb7a":611,"96a5c73e025727aa17057c9d5524d25bf596c2ed":96,"980511bcad1937ab98aee5fb354cd059e66bea97":815,"0296b2abd0bb01774a459fe03526bdec230fbcd3":10,"222e000b3ba60b949046f2d6a619a01e0fc3ce81":18,"9d2a4f217ed525036860da11fe943a2667f5672f":86,"43288e66862f6a667a266de90e05666b2a79165c":21,"f1e433e83969e840bbfe4c460d1741d09bfa1137":46,"93eda06878b62c5b41632336ff11e161d3e280b9":1596,"1ca5924a446d3bafb97e3eeea3074c4e0ee039ee":1133,"85983eec1a357567ba1a5905f74848c70762a869":18,"5716ae5987ae38b6fba8a78f3cd61ad1a5383305":1222,"760590232494c69329cd98832a09d6dd51def1d4":2264,"62423cacd14a7c4675b3718777200a93b14fcbf6":1457,"f843fe5570621224585c9601a8bdbace03aef666":693,"dae91276aa53428bfc4fd124a80a22e27c4e9012":17,"5819a01cdc2fa995281a069590ede0f01a1c3a16":385,"d1b60799ecd46616c2c62afc8e166b1480e7bc84":71,"b04039c2bd925d6c5b4a0ea35bd58a412e8d6a4b":998,"04cccef311a1d668f19620c740f5b1bda516471e":417,"00aaef386fdc76f5566e83fdccfbe113ce318b1e":19,"ec0a57fc4f9d06fe330382691e4321cc267f87a8":763,"4167597a152a70d8016094a14e64ffd826511e05":68,"1fa8cc785dd3d7e348ccd4676ac115ebae09a538":276,"2d72d9c7158c9c70df4a3b430e725f488fe75a48":154,"f1444bec3fd95e93626f43e8d3a8cb20efc9a9cc":352,"db20e491e6d86376f093e234bfe2aacdb39d234e":42,"61ee20275071d6d099a2fef52da0824441ed82f5":390,"3cdb7e2b49e153d06feaccbae00793ddacb0be33":120,"534afe13abd4960c396d1755defb84ed56fd2306":203,"8359a0f72e03c909251dabf2220fbcde52c07fd6":73,"661a16904551db2d7a97809773ecdc62605c71ed":91,"8e8541a5d84166f50c861db44fdb59011c6997ab":127,"2e14a2a51a275246abb63b9a4faffadb6fa72714":97,"ce532e8df719197e9cb183b6a5810303e5505c27":33,"b1108a9e815f5b61419beba50981ebb8797ca63e":63,"cea69a4117bb55ad0d386922829fc23654412eca":44,"e3736564a3e9f035f015852bab03ba4f165f9706":44,"f1e1b0fb0ca84f2463c5f019751f212d79cdbae8":89,"08482154c2d63955a4abbcff2a9e24de5f996f8c":44,"5a1ea427855640e30168446291c8dacfd0538ed3":172,"9cf8c87e8da3697117e35a95415664071556cd67":17,"87f3f54ea6626331429b5d62f29e53499cd93aa5":67,"d4b80b5d80f9473afd0abdfd90d1b91bfd2e76a6":69,"fd3fa869820366da14f12665d5f2b5130e0eeff0":41,"8ca321138ba9cfb5138bd5d6eb5b07989914a8ca":145,"a2030569493ac37fdb55c8ebfef49b8879a5ea8f":123,"f67111a08a20b64d0217d912613e4c80400ee4a8":85,"469758837a768db19e1d5c325a37c1fbd377ad5b":3,"f66e369e41dfa58b76e79ca17e0d58c7cc4d58e6":312,"79078439417c1fb431a0a4142a58e9016854547f":623,"376ab34c0fe0c4fa780cd9fe35c323b756230096":29,"d114845e445bf906b4f697ce3dd28e9b9f7eb447":79,"daf5b16eda21c398eaf7dbccba1f0a234e10bfc1":189,"d3df3e9ea7734ee9c3cfefe96a727c199adb3860":79,"05abd00bf654ed1d27ba2726f90ea266896443fd":67,"5e6ffebdf2f828df63d2b1f2898a953a6a138278":202,"1810996db6f2e406d430f36cb991da0945136c94":62,"bc2c64d901c28b994bc337a4390c18b7cc99876a":161,"c0bd5720853827d1dbf4d2a7ee71634d5ad8333d":62,"07bbf4788a9e221f5cd6d8b0db745e2faa5e1598":57,"c3a32c8343b2a4180489b5ffa7f3e01dd21102d1":136,"776ca554bdfa53a5803fba805a1056869b11d827":115,"152c84efa2daada5907d1ae8d3af7e2f215bbf0f":93,"68e06a174bab41ffc36398c68863e1e329ba7901":162,"c92c7718bf34a0880b7cd89f63de001a93a1bc15":89,"bebe1b911d460a22922457a1d2e701de61f53adc":108,"c2250dbe57c1a59e500084b2fe744edfbd8e7f88":46,"6a0c983c8969bcb0af5b56883c0b322dcb1e8bdc":34,"2b9adaa6ffb9b23151eb0a479f903dc8a472712b":78,"9a95153f0e80bd4afb34cd76ff6908b4d87b6a14":144,"1c748adadfd05aca2febfdbaadb3730bff249ac9":70,"3526a65f5dd58c2ad09f711366cc30dd9ebaf2ed":436,"f9f21fd8a43cb6816cd13166882501e27cce3bd2":128,"fc8efc07456281f50c08c55b1e40ee71d6a0ab30":123,"2467b9d542ac9a3ab370d59d71e4439a3d9904b7":161,"6dbd219a147a461a5921cac8b0ff767bf5cdeee8":54,"30f17ef5a334fb501c81953710654b93982a3e05":134,"c419eadf15630518606ab434387079172070d340":34981},"excluded_import_commits":["0054e671f88362696a0cb791e0ae7e4f18f7ed75","15fee2a035baa6251f297f0dfafc1a03a8efdaf6","3f787ae169e18dca171c32261cd11313c8b5de87","41645255f1f35219f797ce686141cae060e96467","56ac8d0fc7c5df9c3bc84cc933967a1a493521bc","61e12e4c290bc6e19f3cdac6d467166015ab1e3c","709b332d1753003bc941e0d6fb2cf71203c9e06a","85e2ded0e1f5173e6b97c1fb1df937baf3bc2ce6","92fb94d85675ae914d1e3b07b155828b7be34d2f","9b91f0f42e53cbf5530318f2cb94d1a61eab9f4a","b73e4173a3c1e69e02ad6b4e3b43e425e57a5be9","bc00d37ad81d8072c9a2692e42884b5f5edd6ee0","d1882c7f297c07c9a24368c4ff49419e08e4ba85","dc37f9b7310df388ab7f18a6ca754dc85c1ee90c","edf0f36940d7da64f63913a7ed456c908c9e2095","effcccceac26d9381a116c29279c40d471a3b0cb"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"releases":99.0,"flagged_releases":2.0,"max_loc_per_day":5261.9},"findings":[],"evidence":[{"kind":"release-burst","description":"v2.2.8 → v2.3.0: 73,902 lines in 14.04 days (5,261.9 lines/day)","ref":"v2.2.8...v2.3.0","url":"https://github.com/MHSanaei/3x-ui/compare/v2.2.8...v2.3.0","weight":0.4},{"kind":"release-burst","description":"v3.8.0 → v3.8.5: 6,222 lines in 1.3 days (4,769.2 lines/day)","ref":"v3.8.0...v3.8.5","url":"https://github.com/MHSanaei/3x-ui/compare/v3.8.0...v3.8.5","weight":0.4}],"data":{"releases":[{"from":"v1.4.5","to":"v1.4.6","loc":46,"days":0.51,"loc_per_day":89.7,"flagged":false},{"from":"v1.4.6","to":"v1.5.0","loc":505,"days":3.34,"loc_per_day":151.2,"flagged":false},{"from":"v1.5.0","to":"v1.6.0","loc":1611,"days":5.97,"loc_per_day":270.0,"flagged":false},{"from":"v1.6.0","to":"v1.6.1","loc":142,"days":2.05,"loc_per_day":69.4,"flagged":false},{"from":"v1.6.1","to":"v1.7.0","loc":1283,"days":30.29,"loc_per_day":42.4,"flagged":false},{"from":"v1.7.0","to":"v1.7.5","loc":1212,"days":38.62,"loc_per_day":31.4,"flagged":false},{"from":"v1.7.5","to":"v1.7.9","loc":465,"days":76.85,"loc_per_day":6.1,"flagged":false},{"from":"v1.7.9","to":"v2.0.1","loc":36397,"days":57.13,"loc_per_day":637.1,"flagged":false},{"from":"v2.0.1","to":"v2.1.1","loc":1464,"days":34.18,"loc_per_day":42.8,"flagged":false},{"from":"v2.1.1","to":"v2.1.3","loc":685,"days":17.66,"loc_per_day":38.8,"flagged":false},{"from":"v2.1.3","to":"v2.2.1","loc":922,"days":24.29,"loc_per_day":38.0,"flagged":false},{"from":"v2.2.1","to":"v2.2.5","loc":578,"days":12.79,"loc_per_day":45.2,"flagged":false},{"from":"v2.2.5","to":"v2.2.6","loc":148,"days":0.46,"loc_per_day":324.3,"flagged":false},{"from":"v2.2.6","to":"v2.2.7","loc":314,"days":19.63,"loc_per_day":16.0,"flagged":false},{"from":"v2.2.7","to":"v2.2.8","loc":162,"days":2.01,"loc_per_day":80.5,"flagged":false},{"from":"v2.2.8","to":"v2.3.0","loc":73902,"days":14.04,"loc_per_day":5261.9,"flagged":true},{"from":"v2.3.0","to":"v2.3.1","loc":76,"days":22.13,"loc_per_day":3.4,"flagged":false},{"from":"v2.3.1","to":"v2.3.3","loc":92,"days":13.08,"loc_per_day":7.0,"flagged":false},{"from":"v2.3.3","to":"v2.3.4","loc":147,"days":1.56,"loc_per_day":94.3,"flagged":false},{"from":"v2.3.4","to":"v2.3.5","loc":126,"days":14.2,"loc_per_day":8.9,"flagged":false},{"from":"v2.3.5","to":"v2.3.6","loc":253,"days":10.94,"loc_per_day":23.1,"flagged":false},{"from":"v2.3.6","to":"v2.3.7","loc":258,"days":13.39,"loc_per_day":19.3,"flagged":false},{"from":"v2.3.7","to":"v2.3.8","loc":327,"days":7.0,"loc_per_day":46.7,"flagged":false},{"from":"v2.3.8","to":"v2.3.9","loc":144,"days":8.7,"loc_per_day":16.5,"flagged":false},{"from":"v2.3.9","to":"v2.3.10","loc":2,"days":4.32,"loc_per_day":0.5,"flagged":false},{"from":"v2.3.10","to":"v2.3.11","loc":60,"days":7.54,"loc_per_day":8.0,"flagged":false},{"from":"v2.3.11","to":"v2.3.12","loc":528,"days":8.33,"loc_per_day":63.4,"flagged":false},{"from":"v2.3.12","to":"v2.3.13","loc":141,"days":4.88,"loc_per_day":28.9,"flagged":false},{"from":"v2.3.13","to":"v2.3.14","loc":159,"days":18.67,"loc_per_day":8.5,"flagged":false},{"from":"v2.3.14","to":"v2.4.0","loc":266,"days":10.01,"loc_per_day":26.6,"flagged":false},{"from":"v2.4.0","to":"v2.4.1","loc":77,"days":7.28,"loc_per_day":10.6,"flagged":false},{"from":"v2.4.1","to":"v2.4.2","loc":94,"days":7.91,"loc_per_day":11.9,"flagged":false},{"from":"v2.4.2","to":"v2.4.3","loc":31,"days":6.77,"loc_per_day":4.6,"flagged":false},{"from":"v2.4.3","to":"v2.4.5","loc":635,"days":16.12,"loc_per_day":39.4,"flagged":false},{"from":"v2.4.5","to":"v2.4.6","loc":377,"days":13.94,"loc_per_day":27.1,"flagged":false},{"from":"v2.4.6","to":"v2.4.7","loc":253,"days":14.3,"loc_per_day":17.7,"flagged":false},{"from":"v2.4.7","to":"v2.4.8","loc":70,"days":6.94,"loc_per_day":10.1,"flagged":false},{"from":"v2.4.8","to":"v2.4.9","loc":145,"days":24.82,"loc_per_day":5.8,"flagged":false},{"from":"v2.4.9","to":"v2.4.10","loc":104,"days":2.98,"loc_per_day":34.9,"flagged":false},{"from":"v2.4.10","to":"v2.4.11","loc":149,"days":8.46,"loc_per_day":17.6,"flagged":false},{"from":"v2.4.11","to":"v2.5.0","loc":541,"days":31.1,"loc_per_day":17.4,"flagged":false},{"from":"v2.5.0","to":"v2.5.1","loc":26,"days":6.73,"loc_per_day":3.9,"flagged":false},{"from":"v2.5.1","to":"v2.5.2","loc":13,"days":0.75,"loc_per_day":17.4,"flagged":false},{"from":"v2.5.2","to":"v2.5.3","loc":166,"days":21.3,"loc_per_day":7.8,"flagged":false},{"from":"v2.5.3","to":"v2.5.4","loc":29,"days":7.87,"loc_per_day":3.7,"flagged":false},{"from":"v2.5.4","to":"v2.5.5","loc":465,"days":5.02,"loc_per_day":92.7,"flagged":false},{"from":"v2.5.5","to":"v2.5.6","loc":421,"days":9.78,"loc_per_day":43.0,"flagged":false},{"from":"v2.5.6","to":"v2.5.7","loc":1185,"days":22.01,"loc_per_day":53.8,"flagged":false},{"from":"v2.5.7","to":"v2.5.8","loc":45,"days":18.97,"loc_per_day":2.4,"flagged":false},{"from":"v2.5.8","to":"v2.6.0","loc":656,"days":16.13,"loc_per_day":40.7,"flagged":false},{"from":"v2.6.0","to":"v2.6.1","loc":124,"days":46.88,"loc_per_day":2.6,"flagged":false},{"from":"v2.6.1","to":"v2.6.2","loc":62,"days":4.4,"loc_per_day":14.1,"flagged":false},{"from":"v2.6.2","to":"v2.6.3","loc":151,"days":27.64,"loc_per_day":5.5,"flagged":false},{"from":"v2.6.3","to":"v2.6.5","loc":145,"days":1.28,"loc_per_day":112.9,"flagged":false},{"from":"v2.6.5","to":"v2.6.6","loc":188,"days":4.07,"loc_per_day":46.2,"flagged":false},{"from":"v2.6.6","to":"v2.6.7","loc":544,"days":21.8,"loc_per_day":25.0,"flagged":false},{"from":"v2.6.7","to":"v2.6.8","loc":161,"days":8.35,"loc_per_day":19.3,"flagged":false},{"from":"v2.6.8","to":"v2.7.0","loc":144,"days":2.34,"loc_per_day":61.5,"flagged":false},{"from":"v2.7.0","to":"v2.8.0","loc":1097,"days":4.56,"loc_per_day":240.6,"flagged":false},{"from":"v2.8.0","to":"v2.8.1","loc":1013,"days":2.65,"loc_per_day":381.7,"flagged":false},{"from":"v2.8.1","to":"v2.8.2","loc":273,"days":1.44,"loc_per_day":189.9,"flagged":false},{"from":"v2.8.2","to":"v2.8.3","loc":1161,"days":2.87,"loc_per_day":404.0,"flagged":false},{"from":"v2.8.3","to":"v2.8.4","loc":287,"days":2.76,"loc_per_day":103.8,"flagged":false},{"from":"v2.8.4","to":"v2.8.5","loc":1709,"days":20.83,"loc_per_day":82.0,"flagged":false},{"from":"v2.8.5","to":"v2.8.6","loc":3416,"days":80.28,"loc_per_day":42.6,"flagged":false},{"from":"v2.8.6","to":"v2.8.7","loc":492,"days":2.07,"loc_per_day":237.6,"flagged":false},{"from":"v2.8.7","to":"v2.8.8","loc":539,"days":12.96,"loc_per_day":41.6,"flagged":false},{"from":"v2.8.8","to":"v2.8.9","loc":535,"days":13.83,"loc_per_day":38.7,"flagged":false},{"from":"v2.8.9","to":"v2.8.10","loc":806,"days":10.18,"loc_per_day":79.2,"flagged":false},{"from":"v2.8.10","to":"v2.8.11","loc":350,"days":20.81,"loc_per_day":16.8,"flagged":false},{"from":"v2.8.11","to":"v2.9.0","loc":3352,"days":47.28,"loc_per_day":70.9,"flagged":false},{"from":"v2.9.0","to":"v2.9.1","loc":93,"days":0.72,"loc_per_day":129.0,"flagged":false},{"from":"v2.9.1","to":"v2.9.2","loc":512,"days":0.85,"loc_per_day":604.9,"flagged":false},{"from":"v2.9.2","to":"v2.9.3","loc":2245,"days":5.17,"loc_per_day":433.9,"flagged":false},{"from":"v2.9.3","to":"v2.9.4","loc":3056,"days":8.39,"loc_per_day":364.3,"flagged":false},{"from":"v2.9.4","to":"v3.0.0","loc":5593,"days":4.7,"loc_per_day":1188.9,"flagged":false},{"from":"v3.0.0","to":"v3.0.1","loc":3909,"days":0.93,"loc_per_day":4213.3,"flagged":false},{"from":"v3.0.1","to":"v3.0.2","loc":6314,"days":2.82,"loc_per_day":2236.7,"flagged":false},{"from":"v3.0.2","to":"v3.1.0","loc":3521,"days":9.49,"loc_per_day":371.0,"flagged":false},{"from":"v3.1.0","to":"v3.2.0","loc":10309,"days":4.93,"loc_per_day":2089.9,"flagged":false},{"from":"v3.2.0","to":"v3.2.5","loc":3914,"days":3.52,"loc_per_day":1110.8,"flagged":false},{"from":"v3.2.5","to":"v3.2.6","loc":2088,"days":0.74,"loc_per_day":2804.7,"flagged":false},{"from":"v3.2.6","to":"v3.2.7","loc":3982,"days":1.78,"loc_per_day":2239.1,"flagged":false},{"from":"v3.2.7","to":"v3.2.8","loc":3578,"days":1.5,"loc_per_day":2380.3,"flagged":false},{"from":"v3.2.8","to":"v3.3.0","loc":10835,"days":3.71,"loc_per_day":2924.4,"flagged":false},{"from":"v3.3.0","to":"v3.3.1","loc":10659,"days":3.69,"loc_per_day":2886.4,"flagged":false},{"from":"v3.3.1","to":"v3.4.0","loc":22387,"days":10.88,"loc_per_day":2057.7,"flagged":false},{"from":"v3.4.0","to":"v3.4.1","loc":4578,"days":2.3,"loc_per_day":1993.8,"flagged":false},{"from":"v3.4.1","to":"v3.4.2","loc":7773,"days":3.82,"loc_per_day":2036.5,"flagged":false},{"from":"v3.4.2","to":"v3.5.0","loc":19518,"days":13.07,"loc_per_day":1493.4,"flagged":false},{"from":"v3.5.0","to":"v3.6.0","loc":20868,"days":17.21,"loc_per_day":1212.3,"flagged":false},{"from":"v3.6.0","to":"v3.7.0","loc":31185,"days":25.49,"loc_per_day":1223.2,"flagged":false},{"from":"v3.7.0","to":"v3.8.0","loc":44546,"days":21.17,"loc_per_day":2104.3,"flagged":false},{"from":"v3.8.0","to":"v3.8.5","loc":6222,"days":1.3,"loc_per_day":4769.2,"flagged":true},{"from":"v3.8.5","to":"v3.9.0","loc":20736,"days":17.46,"loc_per_day":1187.4,"flagged":false},{"from":"v3.9.0","to":"v3.10.0","loc":10820,"days":9.19,"loc_per_day":1176.9,"flagged":false},{"from":"v3.10.0","to":"v3.10.2","loc":1241,"days":1.96,"loc_per_day":633.2,"flagged":false},{"from":"v3.10.2","to":"v3.11.0","loc":25598,"days":11.16,"loc_per_day":2293.9,"flagged":false},{"from":"v3.11.0","to":"dev-latest","loc":23080,"days":18.99,"loc_per_day":1215.3,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":201805.0,"index":0.149,"count:narrated_steps":4.0,"per_kloc:narrated_steps":0.02,"files:narrated_steps":1.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":52.0,"per_kloc:emoji_in_code":0.258,"files:emoji_in_code":17.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 1: Get ClientTraffic records for emails in the input list.","ref":"internal/web/service/inbound_node.go:1822","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/internal/web/service/inbound_node.go#L1822","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 2: Sort clients by (Up + Down) descending","ref":"internal/web/service/inbound_node.go:1834","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/internal/web/service/inbound_node.go#L1834","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 3: Extract sorted valid emails and track found ones","ref":"internal/web/service/inbound_node.go:1839","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/internal/web/service/inbound_node.go#L1839","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Step 4: Identify emails that were not found in the database","ref":"internal/web/service/inbound_node.go:1847","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/internal/web/service/inbound_node.go#L1847","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":2.0,"secrets_history":4.0,"secrets_nonprod":60.0,"secrets_low_confidence":8.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"docs/content/docs/en/config/amneziawg.mdx","line":197,"fingerprint":"docs/content/docs/en/config/amneziawg.mdx:generic-api-key:197"},{"rule_id":"gitleaks/discord-client-id","severity":"high","message":"Possible discord-client-id secret in the current tree","path":"frontend/src/components/ui/notifications/DiscordNotifications.stories.tsx","line":63,"fingerprint":"frontend/src/components/ui/notifications/DiscordNotifications.stories.tsx:discord-client-id:63"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"frontend/src/components/form/JsonEditor.stories.tsx","line":14,"fingerprint":"frontend/src/components/form/JsonEditor.stories.tsx:generic-api-key:14"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/generated/examples.ts","line":448,"fingerprint":"frontend/src/generated/examples.ts:generic-api-key:448"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"frontend/src/pages/inbounds/form/InboundFormModal.tsx","line":436,"fingerprint":"frontend/src/pages/inbounds/form/InboundFormModal.tsx:generic-api-key:436"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"docs/public/openapi.json","line":7147,"fingerprint":"docs/public/openapi.json:generic-api-key:7147"},{"rule_id":"gitleaks/private-key","severity":"high","message":"Possible private-key secret in the current tree","path":"frontend/src/pages/xray/outbounds/transport/masque.tsx","line":62,"fingerprint":"frontend/src/pages/xray/outbounds/transport/masque.tsx:private-key:62"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"frontend/public/openapi.json","line":7147,"fingerprint":"frontend/public/openapi.json:generic-api-key:7147"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/golden/fixtures/inbound/mtproto-basic.json","line":8,"fingerprint":"frontend/src/test/golden/fixtures/inbound/mtproto-basic.json:generic-api-key:8"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/amneziawg-outbound-adapter.test.ts","line":10,"fingerprint":"frontend/src/test/amneziawg-outbound-adapter.test.ts:generic-api-key:10"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/golden/fixtures/inbound/shadowsocks-2022.json","line":5,"fingerprint":"frontend/src/test/golden/fixtures/inbound/shadowsocks-2022.json:generic-api-key:5"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/__snapshots__/security.test.ts.snap","line":16,"fingerprint":"frontend/src/test/__snapshots__/security.test.ts.snap:generic-api-key:16"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"frontend/src/pages/api-docs/endpoints.ts","line":621,"fingerprint":"frontend/src/pages/api-docs/endpoints.ts:generic-api-key:621"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/golden/fixtures/security/reality-basic.json","line":8,"fingerprint":"frontend/src/test/golden/fixtures/security/reality-basic.json:generic-api-key:8"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/golden/fixtures/inbound/mtproto-domain-fronting.json","line":8,"fingerprint":"frontend/src/test/golden/fixtures/inbound/mtproto-domain-fronting.json:generic-api-key:8"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/golden/fixtures/inbound-full/vless-tcp-reality.json","line":52,"fingerprint":"frontend/src/test/golden/fixtures/inbound-full/vless-tcp-reality.json:generic-api-key:52"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/golden/fixtures/inbound/wireguard-basic.json","line":5,"fingerprint":"frontend/src/test/golden/fixtures/inbound/wireguard-basic.json:generic-api-key:5"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/golden/fixtures/inbound-full/wireguard-server.json","line":23,"fingerprint":"frontend/src/test/golden/fixtures/inbound-full/wireguard-server.json:generic-api-key:23"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/golden/fixtures/inbound-full/shadowsocks-tcp-2022.json","line":23,"fingerprint":"frontend/src/test/golden/fixtures/inbound-full/shadowsocks-tcp-2022.json:generic-api-key:23"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/__snapshots__/inbound-link.test.ts.snap","line":23,"fingerprint":"frontend/src/test/__snapshots__/inbound-link.test.ts.snap:generic-api-key:23"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/__snapshots__/inbound-defaults.test.ts.snap","line":56,"fingerprint":"frontend/src/test/__snapshots__/inbound-defaults.test.ts.snap:generic-api-key:56"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/inbound-form-adapter.test.ts","line":135,"fingerprint":"frontend/src/test/inbound-form-adapter.test.ts:generic-api-key:135"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/inbound-defaults.test.ts","line":85,"fingerprint":"frontend/src/test/inbound-defaults.test.ts:generic-api-key:85"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/mtproto-clients-link.test.ts","line":19,"fingerprint":"frontend/src/test/mtproto-clients-link.test.ts:generic-api-key:19"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/outbound-defaults.test.ts","line":43,"fingerprint":"frontend/src/test/outbound-defaults.test.ts:generic-api-key:43"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/__snapshots__/protocols.test.ts.snap","line":74,"fingerprint":"frontend/src/test/__snapshots__/protocols.test.ts.snap:generic-api-key:74"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/vless-encryption.test.ts","line":5,"fingerprint":"frontend/src/test/vless-encryption.test.ts:generic-api-key:5"},{"rule_id":"gitleaks/private-key","severity":"low","message":"Possible private-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/warp-masque-modal.test.tsx","line":9,"fingerprint":"frontend/src/test/warp-masque-modal.test.tsx:private-key:9"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/inbound-from-db.test.ts","line":124,"fingerprint":"frontend/src/test/inbound-from-db.test.ts:generic-api-key:124"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/wireguard-client-config.test.ts","line":8,"fingerprint":"frontend/src/test/wireguard-client-config.test.ts:generic-api-key:8"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/tunnel-host-endpoints.test.ts","line":36,"fingerprint":"frontend/src/test/tunnel-host-endpoints.test.ts:generic-api-key:36"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/__snapshots__/inbound-full.test.ts.snap","line":195,"fingerprint":"frontend/src/test/__snapshots__/inbound-full.test.ts.snap:generic-api-key:195"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/inbound-link.test.ts","line":714,"fingerprint":"frontend/src/test/inbound-link.test.ts:generic-api-key:714"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/amneziawgnet/client_device_test.go","line":79,"fingerprint":"internal/amneziawgnet/client_device_test.go:generic-api-key:79"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/wireguard-clients-link.test.ts","line":17,"fingerprint":"frontend/src/test/wireguard-clients-link.test.ts:generic-api-key:17"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/amneziawg/params_test.go","line":276,"fingerprint":"internal/amneziawg/params_test.go:generic-api-key:276"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"frontend/src/test/outbound-form-adapter.test.ts","line":350,"fingerprint":"frontend/src/test/outbound-form-adapter.test.ts:generic-api-key:350"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/amneziawgnet/device_test.go","line":590,"fingerprint":"internal/amneziawgnet/device_test.go:generic-api-key:590"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/database/wireguard_domain_strategy_migration_test.go","line":13,"fingerprint":"internal/database/wireguard_domain_strategy_migration_test.go:generic-api-key:13"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/database/model/model_wireguard_peers_test.go","line":19,"fingerprint":"internal/database/model/model_wireguard_peers_test.go:generic-api-key:19"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/database/wireguard_migration_test.go","line":24,"fingerprint":"internal/database/wireguard_migration_test.go:generic-api-key:24"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/sub/controller_test.go","line":283,"fingerprint":"internal/sub/controller_test.go:generic-api-key:283"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/sub/clash_service_test.go","line":1300,"fingerprint":"internal/sub/clash_service_test.go:generic-api-key:1300"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/sub/service_amneziawg_test.go","line":98,"fingerprint":"internal/sub/service_amneziawg_test.go:generic-api-key:98"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/sub/service_mtproto_test.go","line":12,"fingerprint":"internal/sub/service_mtproto_test.go:generic-api-key:12"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/mtproto/manager_test.go","line":11,"fingerprint":"internal/mtproto/manager_test.go:generic-api-key:11"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/database/model/model_wireguard_test.go","line":14,"fingerprint":"internal/database/model/model_wireguard_test.go:generic-api-key:14"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/sub/settings_cache_test.go","line":97,"fingerprint":"internal/sub/settings_cache_test.go:generic-api-key:97"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/web/service/client_bulk_fanout_test.go","line":210,"fingerprint":"internal/web/service/client_bulk_fanout_test.go:generic-api-key:210"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/web/service/client_sync_mtproto_test.go","line":26,"fingerprint":"internal/web/service/client_sync_mtproto_test.go:generic-api-key:26"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/web/service/client_bulk_flow_test.go","line":278,"fingerprint":"internal/web/service/client_bulk_flow_test.go:generic-api-key:278"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/web/service/inbound_options_node_address_test.go","line":29,"fingerprint":"internal/web/service/inbound_options_node_address_test.go:generic-api-key:29"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/web/service/inbound_import_external_proxy_test.go","line":109,"fingerprint":"internal/web/service/inbound_import_external_proxy_test.go:generic-api-key:109"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/web/service/inbound_node_protocol_update_test.go","line":18,"fingerprint":"internal/web/service/inbound_node_protocol_update_test.go:generic-api-key:18"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/web/service/inbound_client_stats_benchmark_test.go","line":68,"fingerprint":"internal/web/service/inbound_client_stats_benchmark_test.go:generic-api-key:68"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/web/service/inbound_node_sidecar_test.go","line":33,"fingerprint":"internal/web/service/inbound_node_sidecar_test.go:generic-api-key:33"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/web/service/mtproto_fake_test.go","line":23,"fingerprint":"internal/web/service/mtproto_fake_test.go:generic-api-key:23"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/web/service/inbound_amneziawg_test.go","line":166,"fingerprint":"internal/web/service/inbound_amneziawg_test.go:generic-api-key:166"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/web/service/node_foreign_client_test.go","line":301,"fingerprint":"internal/web/service/node_foreign_client_test.go:generic-api-key:301"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/web/service/outbound_subscription_test.go","line":667,"fingerprint":"internal/web/service/outbound_subscription_test.go:generic-api-key:667"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/web/service/xray_config_clients_test.go","line":342,"fingerprint":"internal/web/service/xray_config_clients_test.go:generic-api-key:342"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/xray/api_shadowsocks_test.go","line":156,"fingerprint":"internal/xray/api_shadowsocks_test.go:generic-api-key:156"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/xray/outbound_validation_test.go","line":56,"fingerprint":"internal/xray/outbound_validation_test.go:generic-api-key:56"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"internal/xray/hot_diff_test.go","line":572,"fingerprint":"internal/xray/hot_diff_test.go:generic-api-key:572"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 92fb94d856); removed from the current tree but still retrievable","path":"frontend/src/pages/sub/SubPage.tsx","line":225,"fingerprint":"92fb94d85675ae914d1e3b07b155828b7be34d2f:frontend/src/pages/sub/SubPage.tsx:generic-api-key:225"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 3f787ae169); removed from the current tree but still retrievable","path":"frontend/src/test/__snapshots__/finalmask.test.ts.snap","line":120,"fingerprint":"3f787ae169e18dca171c32261cd11313c8b5de87:frontend/src/test/__snapshots__/finalmask.test.ts.snap:generic-api-key:120"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 3f787ae169); removed from the current tree but still retrievable","path":"frontend/src/test/golden/fixtures/finalmask/udp-mask.json","line":4,"fingerprint":"3f787ae169e18dca171c32261cd11313c8b5de87:frontend/src/test/golden/fixtures/finalmask/udp-mask.json:generic-api-key:4"},{"rule_id":"gitleaks/curl-auth-header","severity":"medium","message":"Possible curl-auth-header secret in history (commit edf0f36940); removed from the current tree but still retrievable","path":"frontend/src/pages/api-docs/ApiDocsPage.tsx","line":44,"fingerprint":"edf0f36940d7da64f63913a7ed456c908c9e2095:frontend/src/pages/api-docs/ApiDocsPage.tsx:curl-auth-header:44"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit b97ff40ad6); removed from the current tree but still retrievable","path":"frontend/src/pages/api-docs/endpoints.js","line":704,"fingerprint":"b97ff40ad6ea8996d6bfc168e592a59f64146ef5:frontend/src/pages/api-docs/endpoints.js:generic-api-key:704"},{"rule_id":"gitleaks/curl-auth-header","severity":"medium","message":"Possible curl-auth-header secret in history (commit e642f7324e); removed from the current tree but still retrievable","path":"frontend/src/pages/api-docs/ApiDocsPage.vue","line":29,"fingerprint":"e642f7324e54c08e95577292830304e133a63c80:frontend/src/pages/api-docs/ApiDocsPage.vue:curl-auth-header:29"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit bc00d37ad8); removed from the current tree but still retrievable","path":"frontend/src/pages/sub/SubPage.vue","line":294,"fingerprint":"bc00d37ad81d8072c9a2692e42884b5f5edd6ee0:frontend/src/pages/sub/SubPage.vue:generic-api-key:294"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 10025ffa66); removed from the current tree but still retrievable","path":"web/html/subscription.html","line":234,"fingerprint":"10025ffa66c011fd756af780772260d833460795:web/html/subscription.html:generic-api-key:234"},{"rule_id":"gitleaks/dropbox-api-token","severity":"medium","message":"Possible dropbox-api-token secret in history (commit 2eb9d2e2e8); removed from the current tree but still retrievable","path":"web/assets/ant-design-vue/antd.min.js.map","line":1,"fingerprint":"2eb9d2e2e85bafcc4067515b6f3ed8725823f2b8:web/assets/ant-design-vue/antd.min.js.map:dropbox-api-token:1"},{"rule_id":"gitleaks/dropbox-api-token","severity":"medium","message":"Possible dropbox-api-token secret in history (commit d37dbb7dc8); removed from the current tree but still retrievable","path":"web/assets/ant-design-vue@1.7.8/antd.min.js.map","line":1,"fingerprint":"d37dbb7dc81ee5957e72e1173a9aa9ea626240fb:web/assets/ant-design-vue@1.7.8/antd.min.js.map:dropbox-api-token:1"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":77.0,"findings_high":23.0,"findings_medium":52.0,"findings_low":2.0,"weighted_findings":43.875,"scanned_lines":201803.0,"parse_errors":2.0},"findings":[{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":".oss-scanner/Dockerfile","line":59,"fingerprint":"dockerfile.security.missing-user:.oss-scanner/Dockerfile:59"},{"rule_id":"opengrep/dockerfile.security.missing-user","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"Dockerfile","line":74,"fingerprint":"dockerfile.security.missing-user:Dockerfile:74"},{"rule_id":"opengrep/dockerfile.security.missing-user-entrypoint","severity":"high","message":"By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]","path":"Dockerfile","line":75,"fingerprint":"dockerfile.security.missing-user-entrypoint:Dockerfile:75"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"docs/content/docs/en/reference/api/websocket.mdx","line":4,"fingerprint":"javascript.lang.security.detect-insecure-websocket:docs/content/docs/en/reference/api/websocket.mdx:4"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"docs/content/docs/fa/reference/api/websocket.mdx","line":5,"fingerprint":"javascript.lang.security.detect-insecure-websocket:docs/content/docs/fa/reference/api/websocket.mdx:5"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"docs/content/docs/ru/reference/api/websocket.mdx","line":5,"fingerprint":"javascript.lang.security.detect-insecure-websocket:docs/content/docs/ru/reference/api/websocket.mdx:5"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"docs/content/docs/zh/reference/api/websocket.mdx","line":5,"fingerprint":"javascript.lang.security.detect-insecure-websocket:docs/content/docs/zh/reference/api/websocket.mdx:5"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"docs/public/openapi.json","line":5072,"fingerprint":"javascript.lang.security.detect-insecure-websocket:docs/public/openapi.json:5072"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"frontend/public/openapi.json","line":5072,"fingerprint":"javascript.lang.security.detect-insecure-websocket:frontend/public/openapi.json:5072"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"frontend/src/pages/api-docs/endpoints.ts","line":2885,"fingerprint":"javascript.lang.security.detect-insecure-websocket:frontend/src/pages/api-docs/endpoints.ts:2885"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"internal/amneziawgkern/manager.go","line":617,"fingerprint":"go.lang.security.audit.dangerous-exec-command:internal/amneziawgkern/manager.go:617"},{"rule_id":"opengrep/go.lang.security.audit.sqli.gosql-sqli","severity":"high","message":"Detected string concatenation with a non-literal variable in a \"database/sql\" Go SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use pre [confidence low]","path":"internal/database/dump_sqlite.go","line":166,"fingerprint":"go.lang.security.audit.sqli.gosql-sqli:internal/database/dump_sqlite.go:166"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"internal/mtproto/process.go","line":165,"fingerprint":"go.lang.security.audit.dangerous-exec-command:internal/mtproto/process.go:165"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"internal/web/service/server.go","line":2057,"fingerprint":"go.lang.security.audit.dangerous-exec-command:internal/web/service/server.go:2057"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"internal/web/service/server.go","line":2082,"fingerprint":"go.lang.security.audit.dangerous-exec-command:internal/web/service/server.go:2082"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"internal/web/service/server.go","line":2672,"fingerprint":"go.lang.security.audit.dangerous-exec-command:internal/web/service/server.go:2672"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"internal/web/service/server.go","line":2695,"fingerprint":"go.lang.security.audit.dangerous-exec-command:internal/web/service/server.go:2695"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"internal/web/service/server.go","line":2905,"fingerprint":"go.lang.security.audit.dangerous-exec-command:internal/web/service/server.go:2905"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"internal/web/service/server.go","line":2928,"fingerprint":"go.lang.security.audit.dangerous-exec-command:internal/web/service/server.go:2928"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"internal/web/service/server.go","line":3023,"fingerprint":"go.lang.security.audit.dangerous-exec-command:internal/web/service/server.go:3023"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"internal/xray/process.go","line":628,"fingerprint":"go.lang.security.audit.dangerous-exec-command:internal/xray/process.go:628"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"internal/xray/process.go","line":640,"fingerprint":"go.lang.security.audit.dangerous-exec-command:internal/xray/process.go:640"},{"rule_id":"opengrep/go.lang.security.audit.dangerous-exec-command","severity":"high","message":"Detected non-static command inside Command. Audit the input to 'exec.Command'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"internal/xray/process.go","line":683,"fingerprint":"go.lang.security.audit.dangerous-exec-command:internal/xray/process.go:683"},{"rule_id":"opengrep/typescript.react.security.audit.react-dangerouslysetinnerhtml","severity":"medium","message":"Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HT [confidence medium]","path":"docs/components/mdx/mermaid.tsx","line":41,"fingerprint":"typescript.react.security.audit.react-dangerouslysetinnerhtml:docs/components/mdx/mermaid.tsx:41"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^(\\d+(\\.\\d+)?(ns|us|µs|ms|s|m|h))+$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a  [confidence low]","path":"docs/lib/xray/telegram.ts","line":90,"fingerprint":"javascript.lang.security.audit.detect-redos:docs/lib/xray/telegram.ts:90"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"frontend/src/components/geodata/GeoBrowserModal.stories.tsx","line":25,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:frontend/src/components/geodata/GeoBrowserModal.stories.tsx:25"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"frontend/src/components/geodata/GeoTokenInput.stories.tsx","line":26,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:frontend/src/components/geodata/GeoTokenInput.stories.tsx:26"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"frontend/src/i18n/AntdRootConfig.tsx","line":27,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:frontend/src/i18n/AntdRootConfig.tsx:27"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"frontend/src/i18n/react.ts","line":47,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:frontend/src/i18n/react.ts:47"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"frontend/src/lib/xray/amneziawg-obfuscation.ts","line":121,"fingerprint":"javascript.lang.security.html-in-template-string:frontend/src/lib/xray/amneziawg-obfuscation.ts:121"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^([a-z0-9-]+\\.)+[a-z]{2,}$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a library w [confidence low]","path":"frontend/src/lib/xray/ech-presets.ts","line":106,"fingerprint":"javascript.lang.security.audit.detect-redos:frontend/src/lib/xray/ech-presets.ts:106"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^([a-z0-9-]+\\.)+[a-z]{2,}$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to catastrophic backtracking, and if possible use a library w [confidence low]","path":"frontend/src/lib/xray/ech-presets.ts","line":117,"fingerprint":"javascript.lang.security.audit.detect-redos:frontend/src/lib/xray/ech-presets.ts:117"},{"rule_id":"opengrep/javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop","severity":"medium","message":"Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-exis [confidence low]","path":"frontend/src/lib/xray/forms/transport/FinalMaskForm.tsx","line":798,"fingerprint":"javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop:frontend/src/lib/xray/forms/transport/FinalMaskForm.tsx:798"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(\\.[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to c [confidence low]","path":"frontend/src/lib/xray/inbound-link.ts","line":1331,"fingerprint":"javascript.lang.security.audit.detect-redos:frontend/src/lib/xray/inbound-link.ts:1331"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-redos","severity":"medium","message":"Detected the use of a regular expression `^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(\\.[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?)*$` which appears to be vulnerable to a Regular expression Denial-of-Service (ReDoS). For this reason, it is recommended to review the regex and ensure it is not vulnerable to c [confidence low]","path":"frontend/src/pages/inbounds/form/InboundFormModal.tsx","line":152,"fingerprint":"javascript.lang.security.audit.detect-redos:frontend/src/pages/inbounds/form/InboundFormModal.tsx:152"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `name` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled [confidence low]","path":"frontend/tools/check-inbound-keyboard.mjs","line":51,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:frontend/tools/check-inbound-keyboard.mjs:51"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"frontend/vite.config.js","line":74,"fingerprint":"javascript.lang.security.html-in-template-string:frontend/vite.config.js:74"},{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"frontend/vite.config.js","line":75,"fingerprint":"javascript.lang.security.html-in-template-string:frontend/vite.config.js:75"},{"rule_id":"opengrep/go.lang.security.audit.crypto.math-random-used","severity":"medium","message":"Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium]","path":"internal/amneziawgnet/dns.go","line":6,"fingerprint":"go.lang.security.audit.crypto.math-random-used:internal/amneziawgnet/dns.go:6"},{"rule_id":"opengrep/go.lang.security.audit.crypto.math-random-used","severity":"medium","message":"Do not use `math/rand`. Use `crypto/rand` instead. [confidence medium]","path":"internal/amneziawgnet/egress.go","line":10,"fingerprint":"go.lang.security.audit.crypto.math-random-used:internal/amneziawgnet/egress.go:10"},{"rule_id":"opengrep/go.lang.security.audit.database.string-formatted-query","severity":"medium","message":"String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data. [confidence low]","path":"internal/database/db.go","line":304,"fingerprint":"go.lang.security.audit.database.string-formatted-query:internal/database/db.go:304"},{"rule_id":"opengrep/go.lang.security.audit.database.string-formatted-query","severity":"medium","message":"String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data. [confidence low]","path":"internal/database/dump_sqlite.go","line":166,"fingerprint":"go.lang.security.audit.database.string-formatted-query:internal/database/dump_sqlite.go:166"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"internal/mtproto/process_windows.go","line":36,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:internal/mtproto/process_windows.go:36"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"internal/mtproto/process_windows.go","line":37,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:internal/mtproto/process_windows.go:37"},{"rule_id":"opengrep/go.lang.security.audit.crypto.missing-ssl-minversion","severity":"medium","message":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web se [confidence high]","path":"internal/sub/sub.go","line":435,"fingerprint":"go.lang.security.audit.crypto.missing-ssl-minversion:internal/sub/sub.go:435"},{"rule_id":"opengrep/go.lang.security.audit.crypto.missing-ssl-minversion","severity":"medium","message":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web se [confidence high]","path":"internal/tuic/server.go","line":83,"fingerprint":"go.lang.security.audit.crypto.missing-ssl-minversion:internal/tuic/server.go:83"},{"rule_id":"opengrep/go.lang.security.audit.crypto.missing-ssl-minversion","severity":"medium","message":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web se [confidence high]","path":"internal/util/ldap/ldap.go","line":27,"fingerprint":"go.lang.security.audit.crypto.missing-ssl-minversion:internal/util/ldap/ldap.go:27"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"internal/util/sys/sys_windows.go","line":64,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:internal/util/sys/sys_windows.go:64"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"internal/util/sys/sys_windows.go","line":65,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:internal/util/sys/sys_windows.go:65"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"internal/util/sys/sys_windows.go","line":66,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:internal/util/sys/sys_windows.go:66"},{"rule_id":"opengrep/go.lang.security.audit.xss.import-text-template","severity":"medium","message":"When working with web applications that involve rendering user-generated  content, it's important to properly escape any HTML content to prevent  Cross-Site Scripting (XSS) attacks. In Go, the `text/template` package does  not automatically escape HTML content, which can leave your application  vuln [confidence low]","path":"internal/web/controller/index.go","line":5,"fingerprint":"go.lang.security.audit.xss.import-text-template:internal/web/controller/index.go:5"},{"rule_id":"opengrep/go.lang.security.audit.crypto.use-of-md5","severity":"medium","message":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"internal/web/global/hashStorage.go","line":38,"fingerprint":"go.lang.security.audit.crypto.use-of-md5:internal/web/global/hashStorage.go:38"},{"rule_id":"opengrep/go.lang.security.audit.crypto.missing-ssl-minversion","severity":"medium","message":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web se [confidence high]","path":"internal/web/runtime/tls_client.go","line":327,"fingerprint":"go.lang.security.audit.crypto.missing-ssl-minversion:internal/web/runtime/tls_client.go:327"},{"rule_id":"opengrep/go.lang.security.audit.crypto.missing-ssl-minversion","severity":"medium","message":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web se [confidence high]","path":"internal/web/service/email/email.go","line":86,"fingerprint":"go.lang.security.audit.crypto.missing-ssl-minversion:internal/web/service/email/email.go:86"},{"rule_id":"opengrep/go.lang.security.audit.crypto.missing-ssl-minversion","severity":"medium","message":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web se [confidence high]","path":"internal/web/service/email/email.go","line":212,"fingerprint":"go.lang.security.audit.crypto.missing-ssl-minversion:internal/web/service/email/email.go:212"},{"rule_id":"opengrep/go.lang.security.audit.crypto.missing-ssl-minversion","severity":"medium","message":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web se [confidence high]","path":"internal/web/service/email/email.go","line":318,"fingerprint":"go.lang.security.audit.crypto.missing-ssl-minversion:internal/web/service/email/email.go:318"},{"rule_id":"opengrep/go.lang.security.audit.database.string-formatted-query","severity":"medium","message":"String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data. [confidence low]","path":"internal/web/service/inbound_migration.go","line":21,"fingerprint":"go.lang.security.audit.database.string-formatted-query:internal/web/service/inbound_migration.go:21"},{"rule_id":"opengrep/go.lang.security.audit.crypto.missing-ssl-minversion","severity":"medium","message":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web se [confidence high]","path":"internal/web/service/node.go","line":91,"fingerprint":"go.lang.security.audit.crypto.missing-ssl-minversion:internal/web/service/node.go:91"},{"rule_id":"opengrep/go.lang.security.shared-url-struct-mutation","severity":"medium","message":"Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low]","path":"internal/web/service/node.go","line":417,"fingerprint":"go.lang.security.shared-url-struct-mutation:internal/web/service/node.go:417"},{"rule_id":"opengrep/go.lang.security.shared-url-struct-mutation","severity":"medium","message":"Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low]","path":"internal/web/service/node.go","line":669,"fingerprint":"go.lang.security.shared-url-struct-mutation:internal/web/service/node.go:669"},{"rule_id":"opengrep/go.lang.security.audit.crypto.missing-ssl-minversion","severity":"medium","message":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web se [confidence high]","path":"internal/web/service/outbound/probe_http.go","line":601,"fingerprint":"go.lang.security.audit.crypto.missing-ssl-minversion:internal/web/service/outbound/probe_http.go:601"},{"rule_id":"opengrep/go.lang.security.shared-url-struct-mutation","severity":"medium","message":"Shared URL struct may have been accidentally mutated. Ensure that this behavior is intended. [confidence low]","path":"internal/web/service/outbound/probe_http.go","line":676,"fingerprint":"go.lang.security.shared-url-struct-mutation:internal/web/service/outbound/probe_http.go:676"},{"rule_id":"opengrep/go.lang.security.audit.crypto.missing-ssl-minversion","severity":"medium","message":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web se [confidence high]","path":"internal/web/service/outbound_subscription.go","line":336,"fingerprint":"go.lang.security.audit.crypto.missing-ssl-minversion:internal/web/service/outbound_subscription.go:336"},{"rule_id":"opengrep/go.lang.security.potential-dos-via-decompression-bomb","severity":"medium","message":"Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size. [confidence low]","path":"internal/web/service/server.go","line":1182,"fingerprint":"go.lang.security.potential-dos-via-decompression-bomb:internal/web/service/server.go:1182"},{"rule_id":"opengrep/go.lang.security.audit.unsafe-reflect-by-name","severity":"medium","message":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to  [confidence low]","path":"internal/web/service/setting.go","line":307,"fingerprint":"go.lang.security.audit.unsafe-reflect-by-name:internal/web/service/setting.go:307"},{"rule_id":"opengrep/go.lang.security.audit.unsafe-reflect-by-name","severity":"medium","message":"If an attacker can supply values that the application then uses to determine which method or field to invoke, the potential exists for the attacker to create control flow paths through the application that were not intended by the application developers. This attack vector may allow the attacker to  [confidence low]","path":"internal/web/service/setting.go","line":1724,"fingerprint":"go.lang.security.audit.unsafe-reflect-by-name:internal/web/service/setting.go:1724"},{"rule_id":"opengrep/go.lang.security.audit.net.cookie-missing-secure","severity":"medium","message":"A session cookie was detected without setting the 'Secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'Secure' flag by setting 'Secure' to 'true' in the Options struct. [confidence medium]","path":"internal/web/session/session.go","line":184,"fingerprint":"go.lang.security.audit.net.cookie-missing-secure:internal/web/session/session.go:184"},{"rule_id":"opengrep/go.lang.security.audit.crypto.missing-ssl-minversion","severity":"medium","message":"`MinVersion` is missing from this TLS configuration.  By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server. General purpose web applications should default to TLS 1.3 with all other protocols disabled.  Only where it is known that a web se [confidence high]","path":"internal/web/web.go","line":613,"fingerprint":"go.lang.security.audit.crypto.missing-ssl-minversion:internal/web/web.go:613"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"internal/xray/process_windows.go","line":36,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:internal/xray/process_windows.go:36"},{"rule_id":"opengrep/go.lang.security.audit.use-of-unsafe-block","severity":"medium","message":"Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you'r [confidence low]","path":"internal/xray/process_windows.go","line":37,"fingerprint":"go.lang.security.audit.use-of-unsafe-block:internal/xray/process_windows.go:37"},{"rule_id":"opengrep/go.lang.security.audit.net.use-tls","severity":"medium","message":"Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information. [confidence medium]","path":"main.go","line":103,"fingerprint":"go.lang.security.audit.net.use-tls:main.go:103"},{"rule_id":"opengrep/bash.curl.security.curl-pipe-bash","severity":"medium","message":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checki [confidence low]","path":"x-ui.sh","line":132,"fingerprint":"bash.curl.security.curl-pipe-bash:x-ui.sh:132"},{"rule_id":"opengrep/bash.curl.security.curl-pipe-bash","severity":"medium","message":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checki [confidence low]","path":"x-ui.sh","line":151,"fingerprint":"bash.curl.security.curl-pipe-bash:x-ui.sh:151"},{"rule_id":"opengrep/bash.curl.security.curl-pipe-bash","severity":"medium","message":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checki [confidence low]","path":"x-ui.sh","line":169,"fingerprint":"bash.curl.security.curl-pipe-bash:x-ui.sh:169"},{"rule_id":"opengrep/bash.curl.security.curl-pipe-bash","severity":"medium","message":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checki [confidence low]","path":"x-ui.sh","line":2159,"fingerprint":"bash.curl.security.curl-pipe-bash:x-ui.sh:2159"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"frontend/src/api/websocket.ts","line":171,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:frontend/src/api/websocket.ts:171"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"frontend/src/utils/zodValidate.ts","line":19,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:frontend/src/utils/zodValidate.ts:19"}],"evidence":[],"data":{"rulesets":["go","typescript","javascript","bash","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":4.0,"vulnerabilities":12.0,"vulns_critical":1.0,"vulns_high":3.0,"vulns_medium":4.0,"vulns_low":2.0,"vulns_unknown":2.0,"penalty":34.0},"findings":[{"rule_id":"osv/GHSA-cg2g-xh64-v4q7","severity":"critical","message":"dompurify@3.4.13 (npm) is affected by GHSA-cg2g-xh64-v4q7","path":"docs/pnpm-lock.yaml","line":null,"fingerprint":"dompurify@3.4.13 (npm):GHSA-cg2g-xh64-v4q7"},{"rule_id":"osv/GHSA-mrv2-3pqr-j5jr","severity":"high","message":"dompurify@3.4.13 (npm) is affected by GHSA-mrv2-3pqr-j5jr","path":"docs/pnpm-lock.yaml","line":null,"fingerprint":"dompurify@3.4.13 (npm):GHSA-mrv2-3pqr-j5jr"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"docs/pnpm-lock.yaml","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@8.1.0 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"docs/pnpm-lock.yaml","line":null,"fingerprint":"vite@8.1.0 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-6688-9rhm-gjv2","severity":"medium","message":"dompurify@3.4.13 (npm) is affected by GHSA-6688-9rhm-gjv2","path":"docs/pnpm-lock.yaml","line":null,"fingerprint":"dompurify@3.4.13 (npm):GHSA-6688-9rhm-gjv2"},{"rule_id":"osv/GHSA-c6gr-qvv4-5v3f","severity":"medium","message":"dompurify@3.4.13 (npm) is affected by GHSA-c6gr-qvv4-5v3f","path":"docs/pnpm-lock.yaml","line":null,"fingerprint":"dompurify@3.4.13 (npm):GHSA-c6gr-qvv4-5v3f"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@8.1.0 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"docs/pnpm-lock.yaml","line":null,"fingerprint":"vite@8.1.0 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@8.1.0 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"docs/pnpm-lock.yaml","line":null,"fingerprint":"vite@8.1.0 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@8.1.0 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"docs/pnpm-lock.yaml","line":null,"fingerprint":"vite@8.1.0 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-gcqx-w48m-w2h4","severity":"medium","message":"deepmerge@4.3.1 (npm) is affected by GHSA-gcqx-w48m-w2h4","path":"frontend/package-lock.json","line":null,"fingerprint":"deepmerge@4.3.1 (npm):GHSA-gcqx-w48m-w2h4"},{"rule_id":"osv/GHSA-p98j-92pf-mc4p","severity":"low","message":"dompurify@3.4.13 (npm) is affected by GHSA-p98j-92pf-mc4p","path":"docs/pnpm-lock.yaml","line":null,"fingerprint":"dompurify@3.4.13 (npm):GHSA-p98j-92pf-mc4p"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@8.1.0 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"docs/pnpm-lock.yaml","line":null,"fingerprint":"vite@8.1.0 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["Go","npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":10.0,"findings":104.0,"findings_high":80.0,"findings_medium":3.0,"findings_low":21.0,"penalty":921.3},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":36,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:36"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":37,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:37"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":68,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:68"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":69,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:69"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":180,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:180"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":181,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:181"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":211,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:211"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":212,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:212"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":216,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:216"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":230,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:230"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":231,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:231"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":246,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:246"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":247,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:247"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":264,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:264"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":265,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:265"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":280,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:280"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":281,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:281"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":295,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:295"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":296,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:296"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":303,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:303"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":316,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:316"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":317,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:317"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":338,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:338"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":339,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:339"},{"rule_id":"zizmor/dangerous-triggers","severity":"high","message":"use of fundamentally insecure workflow trigger [confidence medium]","path":".github/workflows/claude-issue-analyst.yml","line":6,"fingerprint":"dangerous-triggers:.github/workflows/claude-issue-analyst.yml:6"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude-issue-analyst.yml","line":39,"fingerprint":"unpinned-uses:.github/workflows/claude-issue-analyst.yml:39"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude-issue-analyst.yml","line":43,"fingerprint":"unpinned-uses:.github/workflows/claude-issue-analyst.yml:43"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude-issue-analyst.yml","line":168,"fingerprint":"unpinned-uses:.github/workflows/claude-issue-analyst.yml:168"},{"rule_id":"zizmor/dangerous-triggers","severity":"high","message":"use of fundamentally insecure workflow trigger [confidence medium]","path":".github/workflows/claude-pr-review.yml","line":6,"fingerprint":"dangerous-triggers:.github/workflows/claude-pr-review.yml:6"},{"rule_id":"zizmor/dangerous-triggers","severity":"high","message":"use of fundamentally insecure workflow trigger [confidence medium]","path":".github/workflows/claude-pr-review.yml","line":4,"fingerprint":"dangerous-triggers:.github/workflows/claude-pr-review.yml:4"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude-pr-review.yml","line":109,"fingerprint":"unpinned-uses:.github/workflows/claude-pr-review.yml:109"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude-pr-review.yml","line":114,"fingerprint":"unpinned-uses:.github/workflows/claude-pr-review.yml:114"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude-pr-review.yml","line":122,"fingerprint":"unpinned-uses:.github/workflows/claude-pr-review.yml:122"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude-pr-review.yml","line":135,"fingerprint":"unpinned-uses:.github/workflows/claude-pr-review.yml:135"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude-pr-review.yml","line":316,"fingerprint":"unpinned-uses:.github/workflows/claude-pr-review.yml:316"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude-pr-review.yml","line":326,"fingerprint":"unpinned-uses:.github/workflows/claude-pr-review.yml:326"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude-pr-review.yml","line":347,"fingerprint":"unpinned-uses:.github/workflows/claude-pr-review.yml:347"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude-pr-review.yml","line":352,"fingerprint":"unpinned-uses:.github/workflows/claude-pr-review.yml:352"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/codeql.yml","line":40,"fingerprint":"unpinned-uses:.github/workflows/codeql.yml:40"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/codeql.yml","line":44,"fingerprint":"unpinned-uses:.github/workflows/codeql.yml:44"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/codeql.yml","line":58,"fingerprint":"unpinned-uses:.github/workflows/codeql.yml:58"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/codeql.yml","line":64,"fingerprint":"unpinned-uses:.github/workflows/codeql.yml:64"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/codeql.yml","line":44,"fingerprint":"cache-poisoning:.github/workflows/codeql.yml:44"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docker.yml","line":18,"fingerprint":"unpinned-uses:.github/workflows/docker.yml:18"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docker.yml","line":24,"fingerprint":"unpinned-uses:.github/workflows/docker.yml:24"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docker.yml","line":35,"fingerprint":"unpinned-uses:.github/workflows/docker.yml:35"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docker.yml","line":38,"fingerprint":"unpinned-uses:.github/workflows/docker.yml:38"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docker.yml","line":41,"fingerprint":"unpinned-uses:.github/workflows/docker.yml:41"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docker.yml","line":47,"fingerprint":"unpinned-uses:.github/workflows/docker.yml:47"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docker.yml","line":54,"fingerprint":"unpinned-uses:.github/workflows/docker.yml:54"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docs-ci.yml","line":29,"fingerprint":"unpinned-uses:.github/workflows/docs-ci.yml:29"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docs-ci.yml","line":31,"fingerprint":"unpinned-uses:.github/workflows/docs-ci.yml:31"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docs-ci.yml","line":35,"fingerprint":"unpinned-uses:.github/workflows/docs-ci.yml:35"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/docs-deploy.yml","line":20,"fingerprint":"excessive-permissions:.github/workflows/docs-deploy.yml:20"},{"rule_id":"zizmor/excessive-permissions","severity":"high","message":"overly broad permissions [confidence high]","path":".github/workflows/docs-deploy.yml","line":21,"fingerprint":"excessive-permissions:.github/workflows/docs-deploy.yml:21"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docs-deploy.yml","line":35,"fingerprint":"unpinned-uses:.github/workflows/docs-deploy.yml:35"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docs-deploy.yml","line":36,"fingerprint":"unpinned-uses:.github/workflows/docs-deploy.yml:36"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docs-deploy.yml","line":39,"fingerprint":"unpinned-uses:.github/workflows/docs-deploy.yml:39"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docs-deploy.yml","line":65,"fingerprint":"unpinned-uses:.github/workflows/docs-deploy.yml:65"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/docs-deploy.yml","line":77,"fingerprint":"unpinned-uses:.github/workflows/docs-deploy.yml:77"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/mutation.yml","line":39,"fingerprint":"unpinned-uses:.github/workflows/mutation.yml:39"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/mutation.yml","line":40,"fingerprint":"unpinned-uses:.github/workflows/mutation.yml:40"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/mutation.yml","line":58,"fingerprint":"unpinned-uses:.github/workflows/mutation.yml:58"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":42,"fingerprint":"unpinned-uses:.github/workflows/release.yml:42"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":45,"fingerprint":"unpinned-uses:.github/workflows/release.yml:45"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":55,"fingerprint":"unpinned-uses:.github/workflows/release.yml:55"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":182,"fingerprint":"unpinned-uses:.github/workflows/release.yml:182"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":190,"fingerprint":"unpinned-uses:.github/workflows/release.yml:190"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":214,"fingerprint":"unpinned-uses:.github/workflows/release.yml:214"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":217,"fingerprint":"unpinned-uses:.github/workflows/release.yml:217"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":226,"fingerprint":"unpinned-uses:.github/workflows/release.yml:226"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":240,"fingerprint":"unpinned-uses:.github/workflows/release.yml:240"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":323,"fingerprint":"unpinned-uses:.github/workflows/release.yml:323"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":331,"fingerprint":"unpinned-uses:.github/workflows/release.yml:331"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":363,"fingerprint":"unpinned-uses:.github/workflows/release.yml:363"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/release.yml","line":366,"fingerprint":"unpinned-uses:.github/workflows/release.yml:366"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":45,"fingerprint":"cache-poisoning:.github/workflows/release.yml:45"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":55,"fingerprint":"cache-poisoning:.github/workflows/release.yml:55"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":217,"fingerprint":"cache-poisoning:.github/workflows/release.yml:217"},{"rule_id":"zizmor/cache-poisoning","severity":"high","message":"runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]","path":".github/workflows/release.yml","line":226,"fingerprint":"cache-poisoning:.github/workflows/release.yml:226"},{"rule_id":"zizmor/dependabot-cooldown","severity":"medium","message":"insufficient cooldown in Dependabot updates [confidence high]","path":".github/dependabot.yml","line":8,"fingerprint":"dependabot-cooldown:.github/dependabot.yml:8"},{"rule_id":"zizmor/dependabot-cooldown","severity":"medium","message":"insufficient cooldown in Dependabot updates [confidence high]","path":".github/dependabot.yml","line":12,"fingerprint":"dependabot-cooldown:.github/dependabot.yml:12"},{"rule_id":"zizmor/dependabot-cooldown","severity":"medium","message":"insufficient cooldown in Dependabot updates [confidence high]","path":".github/dependabot.yml","line":16,"fingerprint":"dependabot-cooldown:.github/dependabot.yml:16"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":36,"fingerprint":"artipacked:.github/workflows/ci.yml:36"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":68,"fingerprint":"artipacked:.github/workflows/ci.yml:68"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":180,"fingerprint":"artipacked:.github/workflows/ci.yml:180"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":211,"fingerprint":"artipacked:.github/workflows/ci.yml:211"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":230,"fingerprint":"artipacked:.github/workflows/ci.yml:230"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":246,"fingerprint":"artipacked:.github/workflows/ci.yml:246"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":264,"fingerprint":"artipacked:.github/workflows/ci.yml:264"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":280,"fingerprint":"artipacked:.github/workflows/ci.yml:280"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":295,"fingerprint":"artipacked:.github/workflows/ci.yml:295"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":316,"fingerprint":"artipacked:.github/workflows/ci.yml:316"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":338,"fingerprint":"artipacked:.github/workflows/ci.yml:338"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/codeql.yml","line":39,"fingerprint":"artipacked:.github/workflows/codeql.yml:39"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/docker.yml","line":18,"fingerprint":"artipacked:.github/workflows/docker.yml:18"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/docs-ci.yml","line":29,"fingerprint":"artipacked:.github/workflows/docs-ci.yml:29"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/docs-deploy.yml","line":35,"fingerprint":"artipacked:.github/workflows/docs-deploy.yml:35"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/mutation.yml","line":39,"fingerprint":"artipacked:.github/workflows/mutation.yml:39"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":41,"fingerprint":"artipacked:.github/workflows/release.yml:41"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":213,"fingerprint":"artipacked:.github/workflows/release.yml:213"},{"rule_id":"zizmor/artipacked","severity":"low","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/release.yml","line":362,"fingerprint":"artipacked:.github/workflows/release.yml:362"},{"rule_id":"zizmor/superfluous-actions","severity":"info","message":"action functionality is already included by the runner [confidence high]","path":".github/workflows/release.yml","line":190,"fingerprint":"superfluous-actions:.github/workflows/release.yml:190"},{"rule_id":"zizmor/superfluous-actions","severity":"info","message":"action functionality is already included by the runner [confidence high]","path":".github/workflows/release.yml","line":331,"fingerprint":"superfluous-actions:.github/workflows/release.yml:331"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":1.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":0.915,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: SECURITY.md","ref":"SECURITY.md","url":null,"weight":0.0},{"kind":"posture","description":"Dependency updates: .github/dependabot.yml","ref":".github/dependabot.yml","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":80.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release dev-latest ships x-ui-linux-386.tar.gz (8 downloads)","ref":"x-ui-linux-386.tar.gz","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-linux-386.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release dev-latest ships x-ui-linux-amd64.tar.gz (323 downloads)","ref":"x-ui-linux-amd64.tar.gz","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-linux-amd64.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release dev-latest ships x-ui-linux-arm64.tar.gz (14 downloads)","ref":"x-ui-linux-arm64.tar.gz","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-linux-arm64.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release dev-latest ships x-ui-linux-armv5.tar.gz (10 downloads)","ref":"x-ui-linux-armv5.tar.gz","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-linux-armv5.tar.gz","weight":0.0},{"kind":"binary-release-asset","description":"release dev-latest ships x-ui-linux-armv6.tar.gz (7 downloads)","ref":"x-ui-linux-armv6.tar.gz","url":"https://github.com/MHSanaei/3x-ui/releases/download/dev-latest/x-ui-linux-armv6.tar.gz","weight":0.0}],"data":{"signals":["binary-release-assets"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":9666.0,"function_nloc":137333.0,"mean_ccn":3.88,"p90_ccn":8.0,"complex_functions":304.0,"long_functions":133.0,"many_param_functions":10.0,"risky_nloc_share":0.2954},"findings":[],"evidence":[{"kind":"complex-function","description":"setRemoteTrafficLocked in internal/web/service/inbound_node.go: complexity 244, 849 lines","ref":"internal/web/service/inbound_node.go","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/internal/web/service/inbound_node.go#L498","weight":1.0},{"kind":"complex-function","description":"answerCallback in internal/web/service/tgbot/tgbot_router.go: complexity 184, 815 lines","ref":"internal/web/service/tgbot/tgbot_router.go","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/internal/web/service/tgbot/tgbot_router.go#L368","weight":1.0},{"kind":"complex-function","description":"InboundInfoModal in frontend/src/pages/inbounds/info/InboundInfoModal.tsx: complexity 137, 701 lines","ref":"frontend/src/pages/inbounds/info/InboundInfoModal.tsx","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/frontend/src/pages/inbounds/info/InboundInfoModal.tsx#L36","weight":1.0},{"kind":"complex-function","description":"MergeClientRecord in internal/database/model/model.go: complexity 133, 223 lines","ref":"internal/database/model/model.go","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/internal/database/model/model.go#L1521","weight":1.0},{"kind":"complex-function","description":"BulkAdjust in internal/web/service/client_bulk.go: complexity 101, 282 lines","ref":"internal/web/service/client_bulk.go","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/internal/web/service/client_bulk.go#L338","weight":1.0},{"kind":"complex-function","description":"UpdateInboundClient in internal/web/service/client_inbound_apply.go: complexity 98, 317 lines","ref":"internal/web/service/client_inbound_apply.go","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/internal/web/service/client_inbound_apply.go#L748","weight":1.0},{"kind":"complex-function","description":"InboundFormModal in frontend/src/pages/inbounds/form/InboundFormModal.tsx: complexity 95, 561 lines","ref":"frontend/src/pages/inbounds/form/InboundFormModal.tsx","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/frontend/src/pages/inbounds/form/InboundFormModal.tsx#L246","weight":1.0},{"kind":"complex-function","description":"AddInboundClient in internal/web/service/client_inbound_apply.go: complexity 80, 262 lines","ref":"internal/web/service/client_inbound_apply.go","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/internal/web/service/client_inbound_apply.go#L402","weight":1.0},{"kind":"complex-function","description":"GetXrayConfig in internal/web/service/xray.go: complexity 80, 257 lines","ref":"internal/web/service/xray.go","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/internal/web/service/xray.go#L172","weight":1.0},{"kind":"complex-function","description":"runSeeders in internal/database/db.go: complexity 76, 205 lines","ref":"internal/database/db.go","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/internal/database/db.go#L1525","weight":1.0}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":147528.0,"duplicated_lines":11409.0,"duplicated_share":0.0773,"files":921.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: DockerEntrypoint.sh:24 and x-ui.sh:2548","ref":"DockerEntrypoint.sh","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/DockerEntrypoint.sh#L24","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: docs/components/tools/outbound-generator.tsx:21 and docs/components/tools/outbound-generator.tsx:36","ref":"docs/components/tools/outbound-generator.tsx","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/docs/components/tools/outbound-generator.tsx#L21","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: docs/components/tools/shared/fields.tsx:22 and docs/components/tools/shared/fields.tsx:78","ref":"docs/components/tools/shared/fields.tsx","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/docs/components/tools/shared/fields.tsx#L22","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: docs/lib/xray/outbounds.ts:91 and frontend/src/lib/xray/outbound-link-parser.ts:145","ref":"docs/lib/xray/outbounds.ts","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/docs/lib/xray/outbounds.ts#L91","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: docs/lib/xray/protocols.ts:29 and docs/lib/xray/protocols.ts:50","ref":"docs/lib/xray/protocols.ts","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/docs/lib/xray/protocols.ts#L29","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: frontend/scripts/build-openapi.mjs:281 and frontend/scripts/build-openapi.mjs:302","ref":"frontend/scripts/build-openapi.mjs","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/frontend/scripts/build-openapi.mjs#L281","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: frontend/src/api/queries/useHostsQuery.ts:24 and frontend/src/api/queries/useRawHostsQuery.ts:42","ref":"frontend/src/api/queries/useHostsQuery.ts","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/frontend/src/api/queries/useHostsQuery.ts#L24","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: frontend/src/components/clients/ClientSpeedTag.tsx:20 and frontend/src/pages/inbounds/list/InboundSpeedTag.tsx:26","ref":"frontend/src/components/clients/ClientSpeedTag.tsx","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/frontend/src/components/clients/ClientSpeedTag.tsx#L20","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: frontend/src/components/clients/ConfigBlock.stories.tsx:9 and frontend/src/components/form/DateTimePicker.stories.tsx:40","ref":"frontend/src/components/clients/ConfigBlock.stories.tsx","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/frontend/src/components/clients/ConfigBlock.stories.tsx#L9","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: frontend/src/components/clients/ConfigBlock.tsx:40 and frontend/src/pages/inbounds/qr/QrPanel.tsx:104","ref":"frontend/src/components/clients/ConfigBlock.tsx","url":"https://github.com/MHSanaei/3x-ui/blob/5297fd3c8495d80fab97ae511553fa545c69e913/frontend/src/components/clients/ConfigBlock.tsx#L40","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":290.0,"weighted_findings":130.0,"scanned_lines":201803.0,"category:best-practice":49.0,"category:correctness":240.0,"category:maintainability":1.0},"findings":[{"rule_id":"opengrep/javascript.react.correctness.hooks.calling-set-state-on-current-state","severity":"high","message":"Calling setState on the current state is always a no-op. Did you mean to change the state like setSvg(!svg) instead?","path":"docs/components/mdx/mermaid.tsx","line":26,"fingerprint":"javascript.react.correctness.hooks.calling-set-state-on-current-state:docs/components/mdx/mermaid.tsx:26"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"docs/app/[lang]/(home)/layout.tsx","line":10,"fingerprint":"typescript.react.best-practice.react-props-spreading:docs/app/[lang]/(home)/layout.tsx:10"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"docs/app/[lang]/docs/[[...slug]]/page.tsx","line":36,"fingerprint":"typescript.react.best-practice.react-props-spreading:docs/app/[lang]/docs/[[...slug]]/page.tsx:36"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"docs/app/[lang]/docs/[[...slug]]/page.tsx","line":36,"fingerprint":"typescript.react.best-practice.react-props-spreading:docs/app/[lang]/docs/[[...slug]]/page.tsx:36"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"docs/app/[lang]/docs/layout.tsx","line":8,"fingerprint":"typescript.react.best-practice.react-props-spreading:docs/app/[lang]/docs/layout.tsx:8"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"docs/components/search-dialog.tsx","line":40,"fingerprint":"typescript.react.best-practice.react-props-spreading:docs/components/search-dialog.tsx:40"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"docs/components/theme-switch.tsx","line":92,"fingerprint":"typescript.react.best-practice.react-props-spreading:docs/components/theme-switch.tsx:92"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"docs/lib/xray/subscription.ts","line":269,"fingerprint":"javascript.lang.correctness.no-stringify-keys:docs/lib/xray/subscription.ts:269"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/form/CipherSuitesSelect.tsx","line":48,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/form/CipherSuitesSelect.tsx:48"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/form/NativeSelect.stories.tsx","line":52,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/form/NativeSelect.stories.tsx:52"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/form/NativeSelect.tsx","line":33,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/form/NativeSelect.tsx:33"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/form/SelectTag.tsx","line":65,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/form/SelectTag.tsx:65"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/form/rhf/FormField.stories.tsx","line":68,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/form/rhf/FormField.stories.tsx:68"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/form/rhf/FormField.stories.tsx","line":105,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/form/rhf/FormField.stories.tsx:105"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/form/rhf/FormField.stories.tsx","line":143,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/form/rhf/FormField.stories.tsx:143"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/form/rhf/FormField.stories.tsx","line":176,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/form/rhf/FormField.stories.tsx:176"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"frontend/src/components/geodata/GeoBrowserModal.stories.tsx","line":750,"fingerprint":"typescript.react.best-practice.react-props-in-state:frontend/src/components/geodata/GeoBrowserModal.stories.tsx:750"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"frontend/src/components/geodata/GeoBrowserModal.stories.tsx","line":751,"fingerprint":"typescript.react.best-practice.react-props-in-state:frontend/src/components/geodata/GeoBrowserModal.stories.tsx:751"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-in-state","severity":"medium","message":"Copying a prop into state in React -- this is bad practice as all updates to it are ignored. Instead, read props directly in your component and avoid copying props into state.","path":"frontend/src/components/geodata/GeoBrowserModal.stories.tsx","line":752,"fingerprint":"typescript.react.best-practice.react-props-in-state:frontend/src/components/geodata/GeoBrowserModal.stories.tsx:752"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/geodata/GeoBrowserModal.stories.tsx","line":765,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/geodata/GeoBrowserModal.stories.tsx:765"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/geodata/GeoBrowserModal.stories.tsx","line":818,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/geodata/GeoBrowserModal.stories.tsx:818"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/geodata/GeoTokenInput.stories.tsx","line":227,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/geodata/GeoTokenInput.stories.tsx:227"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/geodata/GeoTokenInput.stories.tsx","line":269,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/geodata/GeoTokenInput.stories.tsx:269"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/sponsor/SponsorCard.stories.tsx","line":84,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/sponsor/SponsorCard.stories.tsx:84"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/sponsor/SponsorCard.stories.tsx","line":93,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/sponsor/SponsorCard.stories.tsx:93"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/sponsor/SponsorCard.stories.tsx","line":102,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/sponsor/SponsorCard.stories.tsx:102"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/sponsor/SponsorCard.stories.tsx","line":114,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/sponsor/SponsorCard.stories.tsx:114"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/components/sponsor/SponsorCard.stories.tsx","line":131,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/components/sponsor/SponsorCard.stories.tsx:131"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"frontend/src/hooks/useXraySetting.ts","line":324,"fingerprint":"javascript.lang.correctness.no-stringify-keys:frontend/src/hooks/useXraySetting.ts:324"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/pages/clients/BulkAddToGroupModal.tsx","line":69,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/pages/clients/BulkAddToGroupModal.tsx:69"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/pages/clients/ClientBulkAddModal.tsx","line":256,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/pages/clients/ClientBulkAddModal.tsx:256"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/pages/clients/ClientBulkAdjustModal.tsx","line":111,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/pages/clients/ClientBulkAdjustModal.tsx:111"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/pages/clients/ClientFormModal.tsx","line":939,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/pages/clients/ClientFormModal.tsx:939"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/pages/clients/ClientQrModal.tsx","line":226,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/pages/clients/ClientQrModal.tsx:226"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/pages/hosts/HostFormModal.tsx","line":250,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/pages/hosts/HostFormModal.tsx:250"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/pages/hosts/json-forms/OutboundSubtreeJsonForm.tsx","line":60,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/pages/hosts/json-forms/OutboundSubtreeJsonForm.tsx:60"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/pages/inbounds/form/InboundFormModal.tsx","line":1236,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/pages/inbounds/form/InboundFormModal.tsx:1236"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/pages/login/LoginPage.tsx","line":196,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/pages/login/LoginPage.tsx:196"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/pages/nodes/NodeFormModal.tsx","line":257,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/pages/nodes/NodeFormModal.tsx:257"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/pages/settings/SubBalancerFormModal.tsx","line":137,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/pages/settings/SubBalancerFormModal.tsx:137"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/pages/sub/SubPage.tsx","line":150,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/pages/sub/SubPage.tsx:150"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/pages/xray/balancers/BalancerFormModal.tsx","line":215,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/pages/xray/balancers/BalancerFormModal.tsx:215"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/pages/xray/dns/DnsServerModal.tsx","line":173,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/pages/xray/dns/DnsServerModal.tsx:173"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/pages/xray/outbounds/OutboundFormModal.tsx","line":386,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/pages/xray/outbounds/OutboundFormModal.tsx:386"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/pages/xray/overrides/NordModal.tsx","line":368,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/pages/xray/overrides/NordModal.tsx:368"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"frontend/src/pages/xray/overrides/PiaModal.tsx","line":96,"fingerprint":"javascript.lang.correctness.no-replaceall:frontend/src/pages/xray/overrides/PiaModal.tsx:96"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/pages/xray/overrides/PiaModal.tsx","line":322,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/pages/xray/overrides/PiaModal.tsx:322"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/pages/xray/overrides/WarpModal.tsx","line":374,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/pages/xray/overrides/WarpModal.tsx:374"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/src/pages/xray/routing/RuleFormModal.tsx","line":187,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/src/pages/xray/routing/RuleFormModal.tsx:187"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/tools/oxlint/__fixtures__/antd-a11y-ok.tsx","line":12,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/tools/oxlint/__fixtures__/antd-a11y-ok.tsx:12"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/tools/oxlint/__fixtures__/icon-marked.tsx","line":9,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/tools/oxlint/__fixtures__/icon-marked.tsx:9"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"frontend/tools/oxlint/__fixtures__/labelled-control.tsx","line":9,"fingerprint":"typescript.react.best-practice.react-props-spreading:frontend/tools/oxlint/__fixtures__/labelled-control.tsx:9"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"frontend/vite.config.js","line":87,"fingerprint":"javascript.lang.correctness.no-replaceall:frontend/vite.config.js:87"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/amneziawgkern/manager.go","line":511,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/amneziawgkern/manager.go:511"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/database/db.go","line":3472,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/database/db.go:3472"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/database/dbtest/dbtest.go","line":33,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/database/dbtest/dbtest.go:33"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/database/migrate_data.go","line":80,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/database/migrate_data.go:80"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/database/migrate_data.go","line":165,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/database/migrate_data.go:165"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/logger/logger.go","line":91,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/logger/logger.go:91"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/mtproto/manager.go","line":624,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/mtproto/manager.go:624"},{"rule_id":"opengrep/go.lang.best-practice.hidden-goroutine","severity":"medium","message":"Detected a hidden goroutine. Function invocations are expected to synchronous, and this function will execute asynchronously because all it does is call a goroutine. Instead, remove the internal goroutine and call the function using 'go'.","path":"internal/util/common/err.go","line":38,"fingerprint":"go.lang.best-practice.hidden-goroutine:internal/util/common/err.go:38"},{"rule_id":"opengrep/go.lang.maintainability.useless-if-body","severity":"medium","message":"Detected identical statements in the if body and the else body of an if-statement. This will lead to the same code being executed no matter what the if-expression evaluates to. Instead, remove the if statement.","path":"internal/web/controller/xray_setting.go","line":93,"fingerprint":"go.lang.maintainability.useless-if-body:internal/web/controller/xray_setting.go:93"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/web/job/check_client_ip_job.go","line":632,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/web/job/check_client_ip_job.go:632"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/web/job/clear_logs_job.go","line":36,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/web/job/clear_logs_job.go:36"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/web/job/clear_logs_job.go","line":40,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/web/job/clear_logs_job.go:40"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/web/job/clear_logs_job.go","line":64,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/web/job/clear_logs_job.go:64"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/web/job/clear_logs_job.go","line":70,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/web/job/clear_logs_job.go:70"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/web/job/tuic_journal.go","line":41,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/web/job/tuic_journal.go:41"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/web/service/server.go","line":1167,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/web/service/server.go:1167"},{"rule_id":"opengrep/go.lang.correctness.exported_loop_pointer","severity":"medium","message":"`traffic` is a loop pointer that may be exported from the loop. This pointer is shared between loop iterations, so the exported reference will always point to the last loop value, which is likely unintentional. To fix, copy the pointer to a new pointer within the loop.","path":"internal/web/service/tgbot/tgbot_inbound.go","line":143,"fingerprint":"go.lang.correctness.exported_loop_pointer:internal/web/service/tgbot/tgbot_inbound.go:143"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/xray/process.go","line":669,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/xray/process.go:669"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/xray/process.go","line":880,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/xray/process.go:880"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"internal/xray/process.go","line":894,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:internal/xray/process.go:894"},{"rule_id":"opengrep/go.lang.correctness.permissions.incorrect-default-permission","severity":"medium","message":"Detected file permissions that are set to more than `0600` (user/owner can read and write). Setting file permissions to higher than `0600` is most likely unnecessary and violates the principle of least privilege. Instead, set permissions to be `0600` or less for os.Chmod, os.Mkdir, os.OpenFile, os.M","path":"tools/openapigen/main.go","line":153,"fingerprint":"go.lang.correctness.permissions.incorrect-default-permission:tools/openapigen/main.go:153"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"docs/lib/xray/firewall.ts","line":54,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:docs/lib/xray/firewall.ts:54"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"docs/lib/xray/links.ts","line":160,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:docs/lib/xray/links.ts:160"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"docs/lib/xray/links.ts","line":160,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:docs/lib/xray/links.ts:160"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"docs/lib/xray/links.ts","line":160,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:docs/lib/xray/links.ts:160"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"docs/lib/xray/reverse-proxy.ts","line":55,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:docs/lib/xray/reverse-proxy.ts:55"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/lib/xray/inbound-defaults.ts","line":246,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/lib/xray/inbound-defaults.ts:246"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/lib/xray/inbound-defaults.ts","line":246,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/lib/xray/inbound-defaults.ts:246"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/pages/clients/ClientBulkAddModal.tsx","line":231,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/pages/clients/ClientBulkAddModal.tsx:231"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/pages/clients/ClientBulkAddModal.tsx","line":231,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/pages/clients/ClientBulkAddModal.tsx:231"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/pages/clients/ClientBulkAdjustModal.tsx","line":82,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/pages/clients/ClientBulkAdjustModal.tsx:82"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/pages/clients/ClientBulkAdjustModal.tsx","line":82,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/pages/clients/ClientBulkAdjustModal.tsx:82"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/pages/clients/ClientsPage.tsx","line":902,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/pages/clients/ClientsPage.tsx:902"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/pages/clients/ClientsPage.tsx","line":902,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/pages/clients/ClientsPage.tsx:902"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/pages/clients/ClientsPage.tsx","line":966,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/pages/clients/ClientsPage.tsx:966"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/pages/clients/ClientsPage.tsx","line":966,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/pages/clients/ClientsPage.tsx:966"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/pages/clients/ClientsPage.tsx","line":995,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/pages/clients/ClientsPage.tsx:995"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/pages/clients/ClientsPage.tsx","line":995,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/pages/clients/ClientsPage.tsx:995"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/pages/groups/GroupsPage.tsx","line":324,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/pages/groups/GroupsPage.tsx:324"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/pages/groups/GroupsPage.tsx","line":324,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/pages/groups/GroupsPage.tsx:324"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/pages/settings/SettingsPage.tsx","line":133,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/pages/settings/SettingsPage.tsx:133"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"frontend/src/pages/settings/SettingsPage.tsx","line":133,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:frontend/src/pages/settings/SettingsPage.tsx:133"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":91,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:91"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"install.sh","line":524,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:install.sh:524"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":524,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:524"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":529,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:529"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":535,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:535"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":548,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:548"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":549,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:549"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":556,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:556"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":655,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:655"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":668,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:668"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":669,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:669"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":670,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:670"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":679,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:679"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":688,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:688"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":689,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:689"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":690,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:690"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":700,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:700"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":701,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:701"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":705,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:705"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":724,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:724"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":725,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:725"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":789,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:789"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"install.sh","line":824,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:install.sh:824"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":824,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:824"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":827,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:827"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":869,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:869"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":885,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:885"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":895,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:895"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":897,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:897"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":898,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:898"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":901,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:901"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":903,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:903"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":904,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:904"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":921,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:921"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":1087,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:1087"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":1121,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:1121"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":1167,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:1167"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":1367,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:1367"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":1428,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:1428"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":1452,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:1452"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":1461,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:1461"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":1472,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:1472"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":1487,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:1487"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":1786,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:1786"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"install.sh","line":1796,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:install.sh:1796"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":1796,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:1796"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"install.sh","line":1802,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:install.sh:1802"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":1802,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:1802"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"install.sh","line":1827,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:install.sh:1827"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":1827,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:1827"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"install.sh","line":1833,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:install.sh:1833"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":1833,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:1833"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":1903,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:1903"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"install.sh","line":1907,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:install.sh:1907"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"install.sh","line":1909,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:install.sh:1909"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"install.sh","line":1914,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:install.sh:1914"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"install.sh","line":1929,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:install.sh:1929"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"install.sh","line":1932,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:install.sh:1932"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"install.sh","line":1936,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:install.sh:1936"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"install.sh","line":1940,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:install.sh:1940"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":2091,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:2091"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":2092,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:2092"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"install.sh","line":2130,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:install.sh:2130"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":174,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:174"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":175,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:175"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":178,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:178"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":226,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:226"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":478,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:478"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":511,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:511"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":519,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:519"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":524,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:524"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":538,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:538"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"update.sh","line":553,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:update.sh:553"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":553,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:553"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"update.sh","line":558,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:update.sh:558"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":558,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:558"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":566,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:566"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":590,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:590"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"update.sh","line":610,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:update.sh:610"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":618,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:618"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"update.sh","line":621,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:update.sh:621"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":632,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:632"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":633,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:633"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":634,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:634"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":635,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:635"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":636,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:636"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":637,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:637"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":638,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:638"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"update.sh","line":640,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:update.sh:640"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":640,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:640"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"update.sh","line":642,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:update.sh:642"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":642,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:642"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":644,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:644"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":645,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:645"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":646,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:646"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":647,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:647"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"update.sh","line":649,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:update.sh:649"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"update.sh","line":654,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:update.sh:654"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"update.sh","line":656,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:update.sh:656"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"update.sh","line":659,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:update.sh:659"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"update.sh","line":670,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:update.sh:670"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"update.sh","line":673,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:update.sh:673"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"update.sh","line":678,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:update.sh:678"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-command-substitution-in-command","severity":"low","message":"The result of command substitution $(...) or `...`, if unquoted, is split on whitespace or other separators specified by the IFS variable. You should surround it with double quotes to avoid splitting the result.","path":"update.sh","line":682,"fingerprint":"bash.lang.correctness.unquoted-command-substitution-in-command:update.sh:682"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"update.sh","line":693,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:update.sh:693"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":158766.0,"source_lines":201803.0,"test_ratio":0.7867,"ci_files":10.0,"cochange_share":0.9288,"cochange_commits":267.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/claude-issue-analyst.yml","ref":".github/workflows/claude-issue-analyst.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/claude-pr-review.yml","ref":".github/workflows/claude-pr-review.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/cleanup_caches.yml","ref":".github/workflows/cleanup_caches.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/codeql.yml","ref":".github/workflows/codeql.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/docker.yml","ref":".github/workflows/docker.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/docs-ci.yml","ref":".github/workflows/docs-ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/docs-deploy.yml","ref":".github/workflows/docs-deploy.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/mutation.yml","ref":".github/workflows/mutation.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (npm test, pnpm test, go test)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (golangci-lint, shellcheck)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["npm test","pnpm test","go test"],"lint_commands":["golangci-lint","shellcheck"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":0.0,"readme_lines":167.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: docs/tsconfig.json","ref":"docs/tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":23340.0,"other_lines":178463.0,"files_blamed":921.0,"blame_failures":0.0,"quality:ai_findings":7.0,"quality:ai_per_kloc":0.3,"quality:other_findings":193.0,"quality:other_per_kloc":1.081,"quality:ratio":0.28,"security:ai_findings":12.0,"security:ai_per_kloc":0.514,"security:other_findings":63.0,"security:other_per_kloc":0.353,"security:ratio":1.46},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}