{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:00.947701Z","repo":{"ref":{"host":"github.com","owner":"Make-or-Die","name":"WhatToPrompt"},"default_branch":"main","clone_url":"https://github.com/Make-or-Die/WhatToPrompt.git","html_url":"https://github.com/Make-or-Die/WhatToPrompt","description":null,"stars":6,"forks":3,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":196,"primary_language":"TypeScript","license_spdx":null,"created_at":"2025-05-22T00:59:02Z","pushed_at":"2025-05-23T13:24:27Z","security_policy_url":null,"distribution":{"owner_created_at":"2025-05-22T00:51:49Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"8c708400edef2d2cc986488d07d4cc5bbbe2b4c9","profile":{"lines_by_language":{"TypeScript":1018,"JavaScript":57,"SQL":18},"files_by_category":{"source":22,"config":9,"other":8,"binary":2,"docs":1,"generated":1},"source_lines":1093,"test_lines":0},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.41,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":null,"style_index":0.0},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":39.7,"confidence":0.9,"coverage":1.0,"label":"poor","breakdown":{"complexity":58.5,"duplication":100.0,"lint":0.2,"testing":0.0,"docs":40.0,"type_safety":100.0,"process":null},"summary":"Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 18% of function code in complex or long functions; 0% duplicated lines. Weakest area: testing."},"security":{"score":62.1,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":100.0,"dependencies":7.9,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 95 known vulnerabilities in 20 dependencies. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":36.0,"checked":36.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":4.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":1094.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2025-05":{"loc":1094,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":2.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":1094.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":273.25,"median_loc_per_hour":273.25,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":1093.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"findings_high":0.0,"findings_medium":0.0,"findings_low":0.0,"weighted_findings":0.0,"scanned_lines":1075.0,"parse_errors":0.0},"findings":[],"evidence":[],"data":{"rulesets":["typescript","javascript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":20.0,"vulnerabilities":95.0,"vulns_critical":4.0,"vulns_high":51.0,"vulns_medium":35.0,"vulns_low":5.0,"vulns_unknown":0.0,"penalty":152.0},"findings":[{"rule_id":"osv/GHSA-2464-fhr4-w9xw","severity":"critical","message":"next@15.3.2 (npm) is affected by GHSA-2464-fhr4-w9xw","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-2464-fhr4-w9xw"},{"rule_id":"osv/GHSA-2xp9-vwfh-vxw4","severity":"critical","message":"next@15.3.2 (npm) is affected by GHSA-2xp9-vwfh-vxw4","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-2xp9-vwfh-vxw4"},{"rule_id":"osv/GHSA-9qr9-h5gf-34mp","severity":"critical","message":"next@15.3.2 (npm) is affected by GHSA-9qr9-h5gf-34mp","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-9qr9-h5gf-34mp"},{"rule_id":"osv/GHSA-p293-qw3h-jr36","severity":"critical","message":"next@15.3.2 (npm) is affected by GHSA-p293-qw3h-jr36","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-p293-qw3h-jr36"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-3jxr-9vmj-r5cp","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-3jxr-9vmj-r5cp","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-3jxr-9vmj-r5cp"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-mh99-v99m-4gvg","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-mh99-v99m-4gvg","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-mh99-v99m-4gvg"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-rgw5-rvv9-x895","severity":"high","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-rgw5-rvv9-x895","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-rgw5-rvv9-x895"},{"rule_id":"osv/GHSA-73wf-gq98-2v4g","severity":"high","message":"browserslist@4.24.5 (npm) is affected by GHSA-73wf-gq98-2v4g","path":"package-lock.json","line":null,"fingerprint":"browserslist@4.24.5 (npm):GHSA-73wf-gq98-2v4g"},{"rule_id":"osv/GHSA-c83g-rgw3-j3cx","severity":"high","message":"browserslist@4.24.5 (npm) is affected by GHSA-c83g-rgw3-j3cx","path":"package-lock.json","line":null,"fingerprint":"browserslist@4.24.5 (npm):GHSA-c83g-rgw3-j3cx"},{"rule_id":"osv/GHSA-25h7-pfq9-p65f","severity":"high","message":"flatted@3.3.3 (npm) is affected by GHSA-25h7-pfq9-p65f","path":"package-lock.json","line":null,"fingerprint":"flatted@3.3.3 (npm):GHSA-25h7-pfq9-p65f"},{"rule_id":"osv/GHSA-rf6f-7fwh-wjgh","severity":"high","message":"flatted@3.3.3 (npm) is affected by GHSA-rf6f-7fwh-wjgh","path":"package-lock.json","line":null,"fingerprint":"flatted@3.3.3 (npm):GHSA-rf6f-7fwh-wjgh"},{"rule_id":"osv/GHSA-5j98-mcp5-4vw2","severity":"high","message":"glob@10.4.5 (npm) is affected by GHSA-5j98-mcp5-4vw2","path":"package-lock.json","line":null,"fingerprint":"glob@10.4.5 (npm):GHSA-5j98-mcp5-4vw2"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.1.0 (npm) is affected by GHSA-2883-xcg3-v3hh","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-52cp-r559-cp3m","severity":"high","message":"js-yaml@4.1.0 (npm) is affected by GHSA-52cp-r559-cp3m","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-52cp-r559-cp3m"},{"rule_id":"osv/GHSA-5p4m-2wfm-xmqj","severity":"high","message":"js-yaml@4.1.0 (npm) is affected by GHSA-5p4m-2wfm-xmqj","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-5p4m-2wfm-xmqj"},{"rule_id":"osv/GHSA-23c5-xmqv-rm74","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-23c5-xmqv-rm74","path":"package-lock.json","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-23c5-xmqv-rm74"},{"rule_id":"osv/GHSA-3ppc-4f35-3m26","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-3ppc-4f35-3m26","path":"package-lock.json","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-3ppc-4f35-3m26"},{"rule_id":"osv/GHSA-7r86-cg39-jmmj","severity":"high","message":"minimatch@3.1.2 (npm) is affected by GHSA-7r86-cg39-jmmj","path":"package-lock.json","line":null,"fingerprint":"minimatch@3.1.2 (npm):GHSA-7r86-cg39-jmmj"},{"rule_id":"osv/GHSA-23c5-xmqv-rm74","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-23c5-xmqv-rm74","path":"package-lock.json","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-23c5-xmqv-rm74"},{"rule_id":"osv/GHSA-3ppc-4f35-3m26","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-3ppc-4f35-3m26","path":"package-lock.json","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-3ppc-4f35-3m26"},{"rule_id":"osv/GHSA-7r86-cg39-jmmj","severity":"high","message":"minimatch@9.0.5 (npm) is affected by GHSA-7r86-cg39-jmmj","path":"package-lock.json","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-7r86-cg39-jmmj"},{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-28wg-ghj8-5hjv","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-2v37-7h3g-55p8","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-xwg4-73v4-xw9w","severity":"high","message":"nanoid@3.3.11 (npm) is affected by GHSA-xwg4-73v4-xw9w","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.11 (npm):GHSA-xwg4-73v4-xw9w"},{"rule_id":"osv/GHSA-267c-6grr-h53f","severity":"high","message":"next@15.3.2 (npm) is affected by GHSA-267c-6grr-h53f","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-267c-6grr-h53f"},{"rule_id":"osv/GHSA-26hh-7cqf-hhc6","severity":"high","message":"next@15.3.2 (npm) is affected by GHSA-26hh-7cqf-hhc6","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-26hh-7cqf-hhc6"},{"rule_id":"osv/GHSA-36qx-fr4f-26g5","severity":"high","message":"next@15.3.2 (npm) is affected by GHSA-36qx-fr4f-26g5","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-36qx-fr4f-26g5"},{"rule_id":"osv/GHSA-89xv-2m56-2m9x","severity":"high","message":"next@15.3.2 (npm) is affected by GHSA-89xv-2m56-2m9x","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-89xv-2m56-2m9x"},{"rule_id":"osv/GHSA-8h8q-6873-q5fj","severity":"high","message":"next@15.3.2 (npm) is affected by GHSA-8h8q-6873-q5fj","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-8h8q-6873-q5fj"},{"rule_id":"osv/GHSA-c4j6-fc7j-m34r","severity":"high","message":"next@15.3.2 (npm) is affected by GHSA-c4j6-fc7j-m34r","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-c4j6-fc7j-m34r"},{"rule_id":"osv/GHSA-h25m-26qc-wcjf","severity":"high","message":"next@15.3.2 (npm) is affected by GHSA-h25m-26qc-wcjf","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-h25m-26qc-wcjf"},{"rule_id":"osv/GHSA-m99w-x7hq-7vfj","severity":"high","message":"next@15.3.2 (npm) is affected by GHSA-m99w-x7hq-7vfj","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-m99w-x7hq-7vfj"},{"rule_id":"osv/GHSA-mg66-mrh9-m8jx","severity":"high","message":"next@15.3.2 (npm) is affected by GHSA-mg66-mrh9-m8jx","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-mg66-mrh9-m8jx"},{"rule_id":"osv/GHSA-mwv6-3258-q52c","severity":"high","message":"next@15.3.2 (npm) is affected by GHSA-mwv6-3258-q52c","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-mwv6-3258-q52c"},{"rule_id":"osv/GHSA-p3m5-59mp-jv5r","severity":"high","message":"next@15.3.2 (npm) is affected by GHSA-p3m5-59mp-jv5r","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-p3m5-59mp-jv5r"},{"rule_id":"osv/GHSA-p9j2-gv94-2wf4","severity":"high","message":"next@15.3.2 (npm) is affected by GHSA-p9j2-gv94-2wf4","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-p9j2-gv94-2wf4"},{"rule_id":"osv/GHSA-q4gf-8mx6-v5v3","severity":"high","message":"next@15.3.2 (npm) is affected by GHSA-q4gf-8mx6-v5v3","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-q4gf-8mx6-v5v3"},{"rule_id":"osv/GHSA-c2c7-rcm5-vvqj","severity":"high","message":"picomatch@2.3.1 (npm) is affected by GHSA-c2c7-rcm5-vvqj","path":"package-lock.json","line":null,"fingerprint":"picomatch@2.3.1 (npm):GHSA-c2c7-rcm5-vvqj"},{"rule_id":"osv/GHSA-c2c7-rcm5-vvqj","severity":"high","message":"picomatch@4.0.2 (npm) is affected by GHSA-c2c7-rcm5-vvqj","path":"package-lock.json","line":null,"fingerprint":"picomatch@4.0.2 (npm):GHSA-c2c7-rcm5-vvqj"},{"rule_id":"osv/GHSA-6g55-p6wh-862q","severity":"high","message":"postcss@8.4.31 (npm) is affected by GHSA-6g55-p6wh-862q","path":"package-lock.json","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-6g55-p6wh-862q"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.4.31 (npm) is affected by GHSA-r28c-9q8g-f849","path":"package-lock.json","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-6g55-p6wh-862q","severity":"high","message":"postcss@8.5.3 (npm) is affected by GHSA-6g55-p6wh-862q","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.3 (npm):GHSA-6g55-p6wh-862q"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.5.3 (npm) is affected by GHSA-r28c-9q8g-f849","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.3 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-f88m-g3jw-g9cj","severity":"high","message":"sharp@0.34.2 (npm) is affected by GHSA-f88m-g3jw-g9cj","path":"package-lock.json","line":null,"fingerprint":"sharp@0.34.2 (npm):GHSA-f88m-g3jw-g9cj"},{"rule_id":"osv/GHSA-rgj7-g3m4-5g8c","severity":"high","message":"sharp@0.34.2 (npm) is affected by GHSA-rgj7-g3m4-5g8c","path":"package-lock.json","line":null,"fingerprint":"sharp@0.34.2 (npm):GHSA-rgj7-g3m4-5g8c"},{"rule_id":"osv/GHSA-wq5f-xc86-pv6w","severity":"high","message":"sharp@0.34.2 (npm) is affected by GHSA-wq5f-xc86-pv6w","path":"package-lock.json","line":null,"fingerprint":"sharp@0.34.2 (npm):GHSA-wq5f-xc86-pv6w"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@3.25.20 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"package-lock.json","line":null,"fingerprint":"zod@3.25.20 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-2g4f-4pwh-qvx6","severity":"medium","message":"ajv@6.12.6 (npm) is affected by GHSA-2g4f-4pwh-qvx6","path":"package-lock.json","line":null,"fingerprint":"ajv@6.12.6 (npm):GHSA-2g4f-4pwh-qvx6"},{"rule_id":"osv/GHSA-f886-m6hf-6m8v","severity":"medium","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-f886-m6hf-6m8v","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-f886-m6hf-6m8v"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-f886-m6hf-6m8v","severity":"medium","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-f886-m6hf-6m8v","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-f886-m6hf-6m8v"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-3g3m-2fjr-6pw4","severity":"medium","message":"glob@10.4.5 (npm) is affected by GHSA-3g3m-2fjr-6pw4","path":"package-lock.json","line":null,"fingerprint":"glob@10.4.5 (npm):GHSA-3g3m-2fjr-6pw4"},{"rule_id":"osv/GHSA-h67p-54hq-rp68","severity":"medium","message":"js-yaml@4.1.0 (npm) is affected by GHSA-h67p-54hq-rp68","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-h67p-54hq-rp68"},{"rule_id":"osv/GHSA-mh29-5h37-fv8m","severity":"medium","message":"js-yaml@4.1.0 (npm) is affected by GHSA-mh29-5h37-fv8m","path":"package-lock.json","line":null,"fingerprint":"js-yaml@4.1.0 (npm):GHSA-mh29-5h37-fv8m"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@9.0.5 (npm) is affected by GHSA-g3hv-75wg-m249","path":"package-lock.json","line":null,"fingerprint":"minimatch@9.0.5 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-3x4c-7xq6-9pq8","severity":"medium","message":"next@15.3.2 (npm) is affected by GHSA-3x4c-7xq6-9pq8","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-3x4c-7xq6-9pq8"},{"rule_id":"osv/GHSA-4342-x723-ch2f","severity":"medium","message":"next@15.3.2 (npm) is affected by GHSA-4342-x723-ch2f","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-4342-x723-ch2f"},{"rule_id":"osv/GHSA-4633-3j49-mh5q","severity":"medium","message":"next@15.3.2 (npm) is affected by GHSA-4633-3j49-mh5q","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-4633-3j49-mh5q"},{"rule_id":"osv/GHSA-4c39-4ccg-62r3","severity":"medium","message":"next@15.3.2 (npm) is affected by GHSA-4c39-4ccg-62r3","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-4c39-4ccg-62r3"},{"rule_id":"osv/GHSA-4jqv-mc3x-m676","severity":"medium","message":"next@15.3.2 (npm) is affected by GHSA-4jqv-mc3x-m676","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-4jqv-mc3x-m676"},{"rule_id":"osv/GHSA-68g3-v927-f742","severity":"medium","message":"next@15.3.2 (npm) is affected by GHSA-68g3-v927-f742","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-68g3-v927-f742"},{"rule_id":"osv/GHSA-955p-x3mx-jcvp","severity":"medium","message":"next@15.3.2 (npm) is affected by GHSA-955p-x3mx-jcvp","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-955p-x3mx-jcvp"},{"rule_id":"osv/GHSA-9g9p-9gw9-jx7f","severity":"medium","message":"next@15.3.2 (npm) is affected by GHSA-9g9p-9gw9-jx7f","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-9g9p-9gw9-jx7f"},{"rule_id":"osv/GHSA-ffhc-5mcf-pf4q","severity":"medium","message":"next@15.3.2 (npm) is affected by GHSA-ffhc-5mcf-pf4q","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-ffhc-5mcf-pf4q"},{"rule_id":"osv/GHSA-g5qg-72qw-gw5v","severity":"medium","message":"next@15.3.2 (npm) is affected by GHSA-g5qg-72qw-gw5v","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-g5qg-72qw-gw5v"},{"rule_id":"osv/GHSA-ggv3-7p47-pfv8","severity":"medium","message":"next@15.3.2 (npm) is affected by GHSA-ggv3-7p47-pfv8","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-ggv3-7p47-pfv8"},{"rule_id":"osv/GHSA-gx5p-jg67-6x7h","severity":"medium","message":"next@15.3.2 (npm) is affected by GHSA-gx5p-jg67-6x7h","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-gx5p-jg67-6x7h"},{"rule_id":"osv/GHSA-h64f-5h5j-jqjh","severity":"medium","message":"next@15.3.2 (npm) is affected by GHSA-h64f-5h5j-jqjh","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-h64f-5h5j-jqjh"},{"rule_id":"osv/GHSA-mcj8-r9mp-w47p","severity":"medium","message":"next@15.3.2 (npm) is affected by GHSA-mcj8-r9mp-w47p","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-mcj8-r9mp-w47p"},{"rule_id":"osv/GHSA-w37m-7fhw-fmv9","severity":"medium","message":"next@15.3.2 (npm) is affected by GHSA-w37m-7fhw-fmv9","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-w37m-7fhw-fmv9"},{"rule_id":"osv/GHSA-wfc6-r584-vfw7","severity":"medium","message":"next@15.3.2 (npm) is affected by GHSA-wfc6-r584-vfw7","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-wfc6-r584-vfw7"},{"rule_id":"osv/GHSA-xv57-4mr9-wg8v","severity":"medium","message":"next@15.3.2 (npm) is affected by GHSA-xv57-4mr9-wg8v","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-xv57-4mr9-wg8v"},{"rule_id":"osv/GHSA-3v7f-55p6-f55p","severity":"medium","message":"picomatch@2.3.1 (npm) is affected by GHSA-3v7f-55p6-f55p","path":"package-lock.json","line":null,"fingerprint":"picomatch@2.3.1 (npm):GHSA-3v7f-55p6-f55p"},{"rule_id":"osv/GHSA-3v7f-55p6-f55p","severity":"medium","message":"picomatch@4.0.2 (npm) is affected by GHSA-3v7f-55p6-f55p","path":"package-lock.json","line":null,"fingerprint":"picomatch@4.0.2 (npm):GHSA-3v7f-55p6-f55p"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.4.31 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"package-lock.json","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-qx2v-qp2m-jg93","severity":"medium","message":"postcss@8.4.31 (npm) is affected by GHSA-qx2v-qp2m-jg93","path":"package-lock.json","line":null,"fingerprint":"postcss@8.4.31 (npm):GHSA-qx2v-qp2m-jg93"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.5.3 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.3 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-qx2v-qp2m-jg93","severity":"medium","message":"postcss@8.5.3 (npm) is affected by GHSA-qx2v-qp2m-jg93","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.3 (npm):GHSA-qx2v-qp2m-jg93"},{"rule_id":"osv/GHSA-rj75-hqrm-r3gf","severity":"medium","message":"postcss-selector-parser@6.1.2 (npm) is affected by GHSA-rj75-hqrm-r3gf","path":"package-lock.json","line":null,"fingerprint":"postcss-selector-parser@6.1.2 (npm):GHSA-rj75-hqrm-r3gf"},{"rule_id":"osv/GHSA-w9m9-85wc-3x92","severity":"medium","message":"postcss-selector-parser@6.1.2 (npm) is affected by GHSA-w9m9-85wc-3x92","path":"package-lock.json","line":null,"fingerprint":"postcss-selector-parser@6.1.2 (npm):GHSA-w9m9-85wc-3x92"},{"rule_id":"osv/GHSA-48c2-rrv3-qjmp","severity":"medium","message":"yaml@2.8.0 (npm) is affected by GHSA-48c2-rrv3-qjmp","path":"package-lock.json","line":null,"fingerprint":"yaml@2.8.0 (npm):GHSA-48c2-rrv3-qjmp"},{"rule_id":"osv/GHSA-v6h2-p8h4-qcjw","severity":"low","message":"brace-expansion@1.1.11 (npm) is affected by GHSA-v6h2-p8h4-qcjw","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@1.1.11 (npm):GHSA-v6h2-p8h4-qcjw"},{"rule_id":"osv/GHSA-v6h2-p8h4-qcjw","severity":"low","message":"brace-expansion@2.0.1 (npm) is affected by GHSA-v6h2-p8h4-qcjw","path":"package-lock.json","line":null,"fingerprint":"brace-expansion@2.0.1 (npm):GHSA-v6h2-p8h4-qcjw"},{"rule_id":"osv/GHSA-3g8h-86w9-wvmq","severity":"low","message":"next@15.3.2 (npm) is affected by GHSA-3g8h-86w9-wvmq","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-3g8h-86w9-wvmq"},{"rule_id":"osv/GHSA-r2fc-ccr8-96c4","severity":"low","message":"next@15.3.2 (npm) is affected by GHSA-r2fc-ccr8-96c4","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-r2fc-ccr8-96c4"},{"rule_id":"osv/GHSA-vfv6-92ff-j949","severity":"low","message":"next@15.3.2 (npm) is affected by GHSA-vfv6-92ff-j949","path":"package-lock.json","line":null,"fingerprint":"next@15.3.2 (npm):GHSA-vfv6-92ff-j949"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.25,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":41.0,"function_nloc":588.0,"mean_ccn":1.66,"p90_ccn":3.0,"complex_functions":0.0,"long_functions":1.0,"many_param_functions":0.0,"risky_nloc_share":0.1786},"findings":[],"evidence":[{"kind":"complex-function","description":"CreatePromptForm in app/components/CreatePromptForm.tsx: complexity 10, 105 lines","ref":"app/components/CreatePromptForm.tsx","url":"https://github.com/Make-or-Die/WhatToPrompt/blob/8c708400edef2d2cc986488d07d4cc5bbbe2b4c9/app/components/CreatePromptForm.tsx#L27","weight":0.16666666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":764.0,"duplicated_lines":0.0,"duplicated_share":0.0,"files":22.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":27.0,"weighted_findings":27.0,"scanned_lines":1075.0,"category:best-practice":27.0},"findings":[{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/CreatePromptForm.tsx","line":91,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/CreatePromptForm.tsx:91"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/CreatePromptForm.tsx","line":109,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/CreatePromptForm.tsx:109"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/CreatePromptForm.tsx","line":127,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/CreatePromptForm.tsx:127"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/CreatePromptForm.tsx","line":145,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/CreatePromptForm.tsx:145"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"app/components/CreatePromptForm.tsx","line":188,"fingerprint":"typescript.react.best-practice.react-props-spreading:app/components/CreatePromptForm.tsx:188"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/badge.tsx","line":41,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/badge.tsx:41"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/button.tsx","line":52,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/button.tsx:52"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/card.tsx","line":13,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/card.tsx:13"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/card.tsx","line":26,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/card.tsx:26"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/card.tsx","line":36,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/card.tsx:36"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/card.tsx","line":46,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/card.tsx:46"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/card.tsx","line":59,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/card.tsx:59"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/card.tsx","line":69,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/card.tsx:69"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/card.tsx","line":79,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/card.tsx:79"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/input.tsx","line":16,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/input.tsx:16"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/label.tsx","line":19,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/label.tsx:19"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/select.tsx","line":12,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/select.tsx:12"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/select.tsx","line":18,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/select.tsx:18"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/select.tsx","line":24,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/select.tsx:24"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/select.tsx","line":43,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/select.tsx:43"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/select.tsx","line":70,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/select.tsx:70"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/select.tsx","line":96,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/select.tsx:96"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/select.tsx","line":113,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/select.tsx:113"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/select.tsx","line":133,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/select.tsx:133"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/select.tsx","line":149,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/select.tsx:149"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/select.tsx","line":167,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/select.tsx:167"},{"rule_id":"opengrep/typescript.react.best-practice.react-props-spreading","severity":"medium","message":"It's best practice to explicitly pass props to an HTML component rather than use the spread operator. The spread operator risks passing invalid HTML props to an HTML element, which can cause console warnings or worse, give malicious actors a way to inject unexpected attributes.","path":"components/ui/textarea.tsx","line":13,"fingerprint":"typescript.react.best-practice.react-props-spreading:components/ui/textarea.tsx:13"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":0.0,"check:test_ratio":0.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.0,"test_lines":0.0,"source_lines":1093.0,"test_ratio":0.0,"ci_files":0.0,"cochange_share":0.0,"cochange_commits":2.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":0.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":28.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: tsconfig.json","ref":"tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null}],"flags":[]}