{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T14:52:01.036061Z","repo":{"ref":{"host":"github.com","owner":"Maxim-Mazurok","name":"llm-eval-workbench"},"default_branch":"main","clone_url":"https://github.com/Maxim-Mazurok/llm-eval-workbench.git","html_url":"https://github.com/Maxim-Mazurok/llm-eval-workbench","description":"Local HumanEval benchmark workbench with live results for OpenAI-compatible models.","stars":1,"forks":0,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":775,"primary_language":"TypeScript","license_spdx":null,"created_at":"2026-06-05T08:18:30Z","pushed_at":"2026-09-21T01:35:00Z","security_policy_url":null,"distribution":{"owner_created_at":"2014-05-31T18:56:22Z","owner_type":"User","release_assets":[]}},"commit_sha":"696ff42c01da5ac878eb6a1695e1a28093b12b48","profile":{"lines_by_language":{"JavaScript":11405,"TypeScript":10894},"files_by_category":{"source":61,"test":26,"other":10,"docs":7,"config":5,"binary":1,"generated":1},"source_lines":13285,"test_lines":9014},"pillars":{"ai_provenance":{"score":5.1,"confidence":0.93,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.0511,"suspected_share":0.3045,"estimated_share":0.0511,"ai_artifacts":2.0,"flagged_work_units":4.0,"flagged_releases":null,"style_index":0.0},"summary":"Explicit AI attribution on 5% of first-party code added; an estimated 5% including velocity signals."},"quality":{"score":56.5,"confidence":0.9,"coverage":1.0,"label":"weak","breakdown":{"complexity":38.2,"duplication":75.2,"lint":61.3,"testing":55.0,"docs":40.0,"type_safety":100.0,"process":null},"summary":"Code quality is weak: test-to-source ratio 0.68, no CI test run detected; 32% of function code in complex or long functions; 5% duplicated lines. Weakest area: complexity."},"security":{"score":65.5,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":94.6,"dependencies":25.9,"ci_actions":null,"posture":0.0,"scorecard":null},"summary":"Security posture is weak: 43 known vulnerabilities in 12 dependencies. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":17.0,"checked":17.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":94.0,"attributed_commits":6.0,"attributed_commit_share":0.06382978723404255,"effective_loc":28880.0,"attributed_loc":1475.0,"attributed_loc_share":0.051073407202216065,"tools_detected":2.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 3 attributed commits, 959 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"GitHub Copilot coding agent: 3 attributed commits, 516 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"70fdb9e1d29e4519756a165d8a4aeec3a41499d5","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/commit/70fdb9e1d29e4519756a165d8a4aeec3a41499d5","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author copilot-swe-agent[bot]","ref":"f75b9f1e39bbfd2c51e9a53ca2c144edf7f2040a","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/commit/f75b9f1e39bbfd2c51e9a53ca2c144edf7f2040a","weight":0.9},{"kind":"attributed-commit","description":"GitHub Copilot coding agent: author Copilot","ref":"188f48a15c6f63721ee3f6435aa92e6d750ef042","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/commit/188f48a15c6f63721ee3f6435aa92e6d750ef042","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"ad4d5b6de062b65cba4d60f2cd7417ca306a3151","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/commit/ad4d5b6de062b65cba4d60f2cd7417ca306a3151","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"1a4dd369d9c1ed59ba8521e7a7079ff87864ef29","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/commit/1a4dd369d9c1ed59ba8521e7a7079ff87864ef29","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: author email noreply@anthropic.com","ref":"8cfbbe56ab9516df42d99c04f358a42b6563c3b0","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/commit/8cfbbe56ab9516df42d99c04f358a42b6563c3b0","weight":0.9}],"data":{"attributed_loc_by_commit":{"8cfbbe56ab9516df42d99c04f358a42b6563c3b0":446,"1a4dd369d9c1ed59ba8521e7a7079ff87864ef29":167,"ad4d5b6de062b65cba4d60f2cd7417ca306a3151":346,"188f48a15c6f63721ee3f6435aa92e6d750ef042":362,"f75b9f1e39bbfd2c51e9a53ca2c144edf7f2040a":153,"70fdb9e1d29e4519756a165d8a4aeec3a41499d5":1},"tools":{"claude-code":{"name":"Claude Code","commits":3,"loc":959,"first_seen":1786382079,"last_seen":1786488602},"github-copilot":{"name":"GitHub Copilot coding agent","commits":3,"loc":516,"first_seen":1789010701,"last_seen":1789216907}},"monthly":{"2026-06":{"loc":8172,"attributed_loc":0},"2026-07":{"loc":7530,"attributed_loc":0},"2026-08":{"loc":6997,"attributed_loc":959},"2026-09":{"loc":6181,"attributed_loc":516}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":2.0,"workflow_agents":0.0,"tools_configured":2.0,"earliest_adoption":1781633192.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":".claude/launch.json (claude-code configuration)","ref":".claude/launch.json","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/.claude/launch.json","weight":0.5},{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":".claude/launch.json","added_at":1785146362},{"tool":"generic-agent","path":"AGENTS.md","added_at":1781633192}],"workflows":[],"tools":["claude-code","generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":48.0,"flagged_units":4.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":28880.0,"flagged_loc":8794.0,"flagged_loc_share":0.3045013850415512,"max_loc_per_hour":1299.832355406538,"median_loc_per_hour":111.0,"pr_timed_units":0.0,"excluded_import_loc":0.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"1,723 lines of first-party code in ~1.3h (1,300 lines/hour, 3 commit session)","ref":"7870784a2e025765ccff984c7df8a86a856a8757","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/commit/7870784a2e025765ccff984c7df8a86a856a8757","weight":0.38994970662196143},{"kind":"velocity-burst","description":"3,477 lines of first-party code in ~4.0h (869 lines/hour, 1 commit session)","ref":"32fef5c63829a50ff5c73d867562bdfe7c3c2670","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/commit/32fef5c63829a50ff5c73d867562bdfe7c3c2670","weight":0.260775},{"kind":"velocity-burst","description":"1,072 lines of first-party code in ~1.4h (770 lines/hour, 1 commit session)","ref":"4105bacc5eb1a6726dd4a929cf1563c926f11970","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/commit/4105bacc5eb1a6726dd4a929cf1563c926f11970","weight":0.23095152603231597},{"kind":"velocity-burst","description":"2,522 lines of first-party code in ~4.6h (550 lines/hour, 2 commit session)","ref":"61c32f0ef90ff9c0f8182e68f306f881d4ff387c","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/commit/61c32f0ef90ff9c0f8182e68f306f881d4ff387c","weight":0.16491644465972394}],"data":{"flagged_loc_by_commit":{"4105bacc5eb1a6726dd4a929cf1563c926f11970":1072,"32fef5c63829a50ff5c73d867562bdfe7c3c2670":3477,"4439387e5fa7cb7427c54a0a698d63cccc0db2c1":1615,"aa77fb199de28e0f8d6e7980a81dffa23bee2cf2":105,"7870784a2e025765ccff984c7df8a86a856a8757":3,"6a44f135f4a87ab48f04e3613c537a1a197956f5":2177,"61c32f0ef90ff9c0f8182e68f306f881d4ff387c":345},"excluded_import_commits":[]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":13285.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":10.0,"findings_high":0.0,"findings_medium":8.0,"findings_low":2.0,"weighted_findings":2.125,"scanned_lines":13285.0,"parse_errors":1.0},"findings":[{"rule_id":"opengrep/javascript.lang.security.html-in-template-string","severity":"medium","message":"This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS). [confidence low]","path":"scripts/migrate-provider-configs.mjs","line":95,"fingerprint":"javascript.lang.security.html-in-template-string:scripts/migrate-provider-configs.mjs:95"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `run` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled  [confidence low]","path":"scripts/server/domain.mjs","line":94,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:scripts/server/domain.mjs:94"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"scripts/server/lmStudioModel.mjs","line":82,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:scripts/server/lmStudioModel.mjs:82"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"scripts/server/runtimeTestHarness.mjs","line":55,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:scripts/server/runtimeTestHarness.mjs:55"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `pattern` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-control [confidence low]","path":"src/domain/benchmarkMentions.ts","line":13,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/domain/benchmarkMentions.ts:13"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `functionName` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-co [confidence low]","path":"src/domain/comments.ts","line":131,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/domain/comments.ts:131"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `entryPoint` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-cont [confidence low]","path":"src/domain/comments.ts","line":146,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/domain/comments.ts:146"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `originalPrompt` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user- [confidence low]","path":"src/domain/comments.ts","line":146,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:src/domain/comments.ts:146"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"scripts/server/runtime.mjs","line":334,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:scripts/server/runtime.mjs:334"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"scripts/server/runtime.mjs","line":2072,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:scripts/server/runtime.mjs:2072"}],"evidence":[],"data":{"rulesets":["javascript","typescript"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":12.0,"vulnerabilities":43.0,"vulns_critical":1.0,"vulns_high":16.0,"vulns_medium":21.0,"vulns_low":5.0,"vulns_unknown":0.0,"penalty":81.0},"findings":[{"rule_id":"osv/GHSA-w7jw-789q-3m8p","severity":"critical","message":"shell-quote@1.8.3 (npm) is affected by GHSA-w7jw-789q-3m8p","path":"package-lock.json","line":null,"fingerprint":"shell-quote@1.8.3 (npm):GHSA-w7jw-789q-3m8p"},{"rule_id":"osv/GHSA-73wf-gq98-2v4g","severity":"high","message":"browserslist@4.28.2 (npm) is affected by GHSA-73wf-gq98-2v4g","path":"package-lock.json","line":null,"fingerprint":"browserslist@4.28.2 (npm):GHSA-73wf-gq98-2v4g"},{"rule_id":"osv/GHSA-c83g-rgw3-j3cx","severity":"high","message":"browserslist@4.28.2 (npm) is affected by GHSA-c83g-rgw3-j3cx","path":"package-lock.json","line":null,"fingerprint":"browserslist@4.28.2 (npm):GHSA-c83g-rgw3-j3cx"},{"rule_id":"osv/GHSA-28wg-ghj8-5hjv","severity":"high","message":"nanoid@3.3.12 (npm) is affected by GHSA-28wg-ghj8-5hjv","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.12 (npm):GHSA-28wg-ghj8-5hjv"},{"rule_id":"osv/GHSA-2v37-7h3g-55p8","severity":"high","message":"nanoid@3.3.12 (npm) is affected by GHSA-2v37-7h3g-55p8","path":"package-lock.json","line":null,"fingerprint":"nanoid@3.3.12 (npm):GHSA-2v37-7h3g-55p8"},{"rule_id":"osv/GHSA-r28c-9q8g-f849","severity":"high","message":"postcss@8.5.15 (npm) is affected by GHSA-r28c-9q8g-f849","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.15 (npm):GHSA-r28c-9q8g-f849"},{"rule_id":"osv/GHSA-395f-4hp3-45gv","severity":"high","message":"shell-quote@1.8.3 (npm) is affected by GHSA-395f-4hp3-45gv","path":"package-lock.json","line":null,"fingerprint":"shell-quote@1.8.3 (npm):GHSA-395f-4hp3-45gv"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"package-lock.json","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-2m5v-pch6-74hx","severity":"high","message":"undici@7.28.0 (npm) is affected by GHSA-2m5v-pch6-74hx","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-2m5v-pch6-74hx"},{"rule_id":"osv/GHSA-4cwx-7wf7-3272","severity":"high","message":"undici@7.28.0 (npm) is affected by GHSA-4cwx-7wf7-3272","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-4cwx-7wf7-3272"},{"rule_id":"osv/GHSA-4w7w-5xrc-9h26","severity":"high","message":"undici@7.28.0 (npm) is affected by GHSA-4w7w-5xrc-9h26","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-4w7w-5xrc-9h26"},{"rule_id":"osv/GHSA-qrxm-fqhp-jwvm","severity":"high","message":"undici@7.28.0 (npm) is affected by GHSA-qrxm-fqhp-jwvm","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-qrxm-fqhp-jwvm"},{"rule_id":"osv/GHSA-rfgv-xxqx-mfg5","severity":"high","message":"undici@7.28.0 (npm) is affected by GHSA-rfgv-xxqx-mfg5","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-rfgv-xxqx-mfg5"},{"rule_id":"osv/GHSA-w293-vg96-wgc3","severity":"high","message":"undici@7.28.0 (npm) is affected by GHSA-w293-vg96-wgc3","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-w293-vg96-wgc3"},{"rule_id":"osv/GHSA-xjj6-f33q-929c","severity":"high","message":"undici@7.28.0 (npm) is affected by GHSA-xjj6-f33q-929c","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-xjj6-f33q-929c"},{"rule_id":"osv/GHSA-587h-7wmj-h5pm","severity":"high","message":"vite@7.3.5 (npm) is affected by GHSA-587h-7wmj-h5pm","path":"package-lock.json","line":null,"fingerprint":"vite@7.3.5 (npm):GHSA-587h-7wmj-h5pm"},{"rule_id":"osv/GHSA-mrhx-c7xc-m3w5","severity":"high","message":"zod@3.25.76 (npm) is affected by GHSA-mrhx-c7xc-m3w5","path":"package-lock.json","line":null,"fingerprint":"zod@3.25.76 (npm):GHSA-mrhx-c7xc-m3w5"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"@vitest/mocker@4.1.9 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@4.1.9 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-qxg6-89mg-rqv8","severity":"medium","message":"@vitest/mocker@4.1.9 (npm) is affected by GHSA-qxg6-89mg-rqv8","path":"package-lock.json","line":null,"fingerprint":"@vitest/mocker@4.1.9 (npm):GHSA-qxg6-89mg-rqv8"},{"rule_id":"osv/GHSA-w5vr-8v7q-w6rv","severity":"medium","message":"baseline-browser-mapping@2.10.33 (npm) is affected by GHSA-w5vr-8v7q-w6rv","path":"package-lock.json","line":null,"fingerprint":"baseline-browser-mapping@2.10.33 (npm):GHSA-w5vr-8v7q-w6rv"},{"rule_id":"osv/GHSA-fxqj-rqcc-2cmp","severity":"medium","message":"postcss@8.5.15 (npm) is affected by GHSA-fxqj-rqcc-2cmp","path":"package-lock.json","line":null,"fingerprint":"postcss@8.5.15 (npm):GHSA-fxqj-rqcc-2cmp"},{"rule_id":"osv/GHSA-2jfj-6hjv-fm6j","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-2jfj-6hjv-fm6j","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-2jfj-6hjv-fm6j"},{"rule_id":"osv/GHSA-3wwx-pv8p-q78v","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-3wwx-pv8p-q78v","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-3wwx-pv8p-q78v"},{"rule_id":"osv/GHSA-3xpg-4rpp-hhhm","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-3xpg-4rpp-hhhm","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-3xpg-4rpp-hhhm"},{"rule_id":"osv/GHSA-4qv8-2p9j-2685","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-4qv8-2p9j-2685","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-4qv8-2p9j-2685"},{"rule_id":"osv/GHSA-55wc-3pg8-jfw6","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-55wc-3pg8-jfw6","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-55wc-3pg8-jfw6"},{"rule_id":"osv/GHSA-8xcm-r25x-g524","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-8xcm-r25x-g524","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-8xcm-r25x-g524"},{"rule_id":"osv/GHSA-9fm3-97px-rjf6","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-9fm3-97px-rjf6","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-9fm3-97px-rjf6"},{"rule_id":"osv/GHSA-f72v-6w45-q472","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-f72v-6w45-q472","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-f72v-6w45-q472"},{"rule_id":"osv/GHSA-jr45-8vmc-qm54","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-jr45-8vmc-qm54","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-jr45-8vmc-qm54"},{"rule_id":"osv/GHSA-m8rv-5g2x-5cg5","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-m8rv-5g2x-5cg5","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-m8rv-5g2x-5cg5"},{"rule_id":"osv/GHSA-pmjh-fq2x-6v4x","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-pmjh-fq2x-6v4x","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-pmjh-fq2x-6v4x"},{"rule_id":"osv/GHSA-rx4f-c7p8-82vq","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-rx4f-c7p8-82vq","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-rx4f-c7p8-82vq"},{"rule_id":"osv/GHSA-v3r7-h72x-cjcm","severity":"medium","message":"undici@7.28.0 (npm) is affected by GHSA-v3r7-h72x-cjcm","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-v3r7-h72x-cjcm"},{"rule_id":"osv/GHSA-698v-4r3x-3vcv","severity":"medium","message":"vite@7.3.5 (npm) is affected by GHSA-698v-4r3x-3vcv","path":"package-lock.json","line":null,"fingerprint":"vite@7.3.5 (npm):GHSA-698v-4r3x-3vcv"},{"rule_id":"osv/GHSA-r825-w8mm-5pxw","severity":"medium","message":"vite@7.3.5 (npm) is affected by GHSA-r825-w8mm-5pxw","path":"package-lock.json","line":null,"fingerprint":"vite@7.3.5 (npm):GHSA-r825-w8mm-5pxw"},{"rule_id":"osv/GHSA-rq7h-c2jc-7f22","severity":"medium","message":"vite@7.3.5 (npm) is affected by GHSA-rq7h-c2jc-7f22","path":"package-lock.json","line":null,"fingerprint":"vite@7.3.5 (npm):GHSA-rq7h-c2jc-7f22"},{"rule_id":"osv/GHSA-82fw-gwwq-j7x9","severity":"medium","message":"vitest@4.1.9 (npm) is affected by GHSA-82fw-gwwq-j7x9","path":"package-lock.json","line":null,"fingerprint":"vitest@4.1.9 (npm):GHSA-82fw-gwwq-j7x9"},{"rule_id":"osv/GHSA-g7r4-m6w7-qqqr","severity":"low","message":"esbuild@0.27.7 (npm) is affected by GHSA-g7r4-m6w7-qqqr","path":"package-lock.json","line":null,"fingerprint":"esbuild@0.27.7 (npm):GHSA-g7r4-m6w7-qqqr"},{"rule_id":"osv/GHSA-2gqq-gqf2-x968","severity":"low","message":"undici@7.28.0 (npm) is affected by GHSA-2gqq-gqf2-x968","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-2gqq-gqf2-x968"},{"rule_id":"osv/GHSA-8436-99hf-9mmv","severity":"low","message":"undici@7.28.0 (npm) is affected by GHSA-8436-99hf-9mmv","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-8436-99hf-9mmv"},{"rule_id":"osv/GHSA-r53p-7pc4-xj5r","severity":"low","message":"undici@7.28.0 (npm) is affected by GHSA-r53p-7pc4-xj5r","path":"package-lock.json","line":null,"fingerprint":"undici@7.28.0 (npm):GHSA-r53p-7pc4-xj5r"},{"rule_id":"osv/GHSA-9jrq-w75r-8gcw","severity":"low","message":"vite@7.3.5 (npm) is affected by GHSA-9jrq-w75r-8gcw","path":"package-lock.json","line":null,"fingerprint":"vite@7.3.5 (npm):GHSA-9jrq-w75r-8gcw"}],"evidence":[],"data":{"ecosystems":["npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":1.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"readme-download-lure","description":"gives an archive password","ref":"README.md","url":null,"weight":0.0}],"data":{"signals":["readme-download-lure"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1152.0,"function_nloc":11384.0,"mean_ccn":3.24,"p90_ccn":7.0,"complex_functions":32.0,"long_functions":15.0,"many_param_functions":0.0,"risky_nloc_share":0.3209},"findings":[],"evidence":[{"kind":"complex-function","description":"(anonymous) in src/components/TaskResults.tsx: complexity 104, 128 lines","ref":"src/components/TaskResults.tsx","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/src/components/TaskResults.tsx#L163","weight":1.0},{"kind":"complex-function","description":"(anonymous) in scripts/server/runtime.mjs: complexity 84, 298 lines","ref":"scripts/server/runtime.mjs","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/scripts/server/runtime.mjs#L2077","weight":1.0},{"kind":"complex-function","description":"applyResumeConfig in scripts/server/runtime.mjs: complexity 43, 137 lines","ref":"scripts/server/runtime.mjs","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/scripts/server/runtime.mjs#L1764","weight":0.7166666666666667},{"kind":"complex-function","description":"runtimeConfigFromPersistedRun in scripts/server/domain.mjs: complexity 37, 36 lines","ref":"scripts/server/domain.mjs","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/scripts/server/domain.mjs#L194","weight":0.6166666666666667},{"kind":"complex-function","description":"runTask in scripts/server/runtime.mjs: complexity 31, 258 lines","ref":"scripts/server/runtime.mjs","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/scripts/server/runtime.mjs#L1005","weight":0.5166666666666667},{"kind":"complex-function","description":"countPythonCommentLines in src/domain/comments.ts: complexity 29, 96 lines","ref":"src/domain/comments.ts","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/src/domain/comments.ts#L8","weight":0.48333333333333334},{"kind":"complex-function","description":"taskGroupsFromRun in src/domain/tasks.ts: complexity 29, 101 lines","ref":"src/domain/tasks.ts","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/src/domain/tasks.ts#L49","weight":0.48333333333333334},{"kind":"complex-function","description":"createRun in scripts/server/runtime.mjs: complexity 27, 170 lines","ref":"scripts/server/runtime.mjs","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/scripts/server/runtime.mjs#L1575","weight":0.45},{"kind":"complex-function","description":"parseArguments in scripts/analyze-benchmark-failures.mjs: complexity 26, 56 lines","ref":"scripts/analyze-benchmark-failures.mjs","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/scripts/analyze-benchmark-failures.mjs#L356","weight":0.43333333333333335},{"kind":"complex-function","description":"loadPersistedRuns in scripts/server/runtime.mjs: complexity 26, 104 lines","ref":"scripts/server/runtime.mjs","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/scripts/server/runtime.mjs#L1967","weight":0.43333333333333335}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":10473.0,"duplicated_lines":499.0,"duplicated_share":0.0476,"files":61.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/analyze-benchmark-failures.mjs:38 and scripts/reprocess-saved-results.mjs:71","ref":"scripts/analyze-benchmark-failures.mjs","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/scripts/analyze-benchmark-failures.mjs#L38","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/reprocess-saved-results.mjs:239 and scripts/update-saved-results.mjs:244","ref":"scripts/reprocess-saved-results.mjs","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/scripts/reprocess-saved-results.mjs#L239","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/reprocess-saved-results.mjs:307 and scripts/server/testHarness.mjs:100","ref":"scripts/reprocess-saved-results.mjs","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/scripts/reprocess-saved-results.mjs#L307","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/server/createBenchmarkServer.mjs:84 and scripts/server/createBenchmarkServer.mjs:126","ref":"scripts/server/createBenchmarkServer.mjs","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/scripts/server/createBenchmarkServer.mjs#L84","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/server/repetitionDetector.mjs:130 and scripts/server/repetitionDetector.mjs:144","ref":"scripts/server/repetitionDetector.mjs","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/scripts/server/repetitionDetector.mjs#L130","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/server/runtime.mjs:566 and scripts/server/runtime.mjs:637","ref":"scripts/server/runtime.mjs","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/scripts/server/runtime.mjs#L566","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/server/runtime.mjs:1224 and scripts/update-saved-results.mjs:93","ref":"scripts/server/runtime.mjs","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/scripts/server/runtime.mjs#L1224","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: scripts/server/testHarness.mjs:191 and scripts/server/testHarness.mjs:210","ref":"scripts/server/testHarness.mjs","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/scripts/server/testHarness.mjs#L191","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/App.tsx:17 and src/hooks/useBenchmarkController.ts:561","ref":"src/App.tsx","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/src/App.tsx#L17","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: src/components/ModelCombobox.tsx:55 and src/components/MultiSelectFilter.tsx:27","ref":"src/components/ModelCombobox.tsx","url":"https://github.com/Maxim-Mazurok/llm-eval-workbench/blob/696ff42c01da5ac878eb6a1695e1a28093b12b48/src/components/ModelCombobox.tsx#L55","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":35.0,"weighted_findings":26.0,"scanned_lines":13285.0,"category:best-practice":1.0,"category:correctness":34.0},"findings":[{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/analyze-benchmark-failures.mjs","line":291,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/analyze-benchmark-failures.mjs:291"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/migrate-loop-detection.mjs","line":50,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/migrate-loop-detection.mjs:50"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/migrate-loop-detection.mjs","line":50,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/migrate-loop-detection.mjs:50"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/migrate-provider-configs.mjs","line":118,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/migrate-provider-configs.mjs:118"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/migrate-provider-configs.mjs","line":118,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/migrate-provider-configs.mjs:118"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/reprocess-saved-results.mjs","line":449,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/reprocess-saved-results.mjs:449"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/reprocess-saved-results.mjs","line":449,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/reprocess-saved-results.mjs:449"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/server/benchmarks/bbehEvaluate.mjs","line":62,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/server/benchmarks/bbehEvaluate.mjs:62"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/server/benchmarks/bbehEvaluate.mjs","line":102,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/server/benchmarks/bbehEvaluate.mjs:102"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/server/benchmarks/bbehEvaluate.mjs","line":102,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/server/benchmarks/bbehEvaluate.mjs:102"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/server/benchmarks/bbehEvaluate.mjs","line":115,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/server/benchmarks/bbehEvaluate.mjs:115"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/server/benchmarks/bbehEvaluate.mjs","line":115,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/server/benchmarks/bbehEvaluate.mjs:115"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/server/benchmarks/bbehEvaluate.mjs","line":122,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/server/benchmarks/bbehEvaluate.mjs:122"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"scripts/server/credentialStore.mjs","line":52,"fingerprint":"javascript.lang.best-practice.lazy-load-module:scripts/server/credentialStore.mjs:52"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/server/domain.mjs","line":301,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/server/domain.mjs:301"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/server/domain.mjs","line":301,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/server/domain.mjs:301"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/server/domain.mjs","line":344,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/server/domain.mjs:344"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/server/domain.mjs","line":344,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/server/domain.mjs:344"},{"rule_id":"opengrep/javascript.lang.correctness.no-stringify-keys","severity":"medium","message":"JSON stringify does not produce a stable key ordering, and should not be relied on for producing object keys. Consider using json-stable-stringify instead.","path":"scripts/server/runtime.mjs","line":417,"fingerprint":"javascript.lang.correctness.no-stringify-keys:scripts/server/runtime.mjs:417"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/update-saved-results.mjs","line":26,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/update-saved-results.mjs:26"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"scripts/update-saved-results.mjs","line":26,"fingerprint":"javascript.lang.correctness.no-replaceall:scripts/update-saved-results.mjs:26"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"src/domain/prompts.ts","line":19,"fingerprint":"javascript.lang.correctness.no-replaceall:src/domain/prompts.ts:19"},{"rule_id":"opengrep/javascript.lang.correctness.no-replaceall","severity":"medium","message":"The string method replaceAll is not supported in all versions of javascript, and is not supported by older browser versions. Consider using replace() with a regex as the first argument instead like mystring.replace(/bad/g, \"good\") instead of mystring.replaceAll(\"bad\", \"good\") (https://discourse.thre","path":"src/domain/prompts.ts","line":19,"fingerprint":"javascript.lang.correctness.no-replaceall:src/domain/prompts.ts:19"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/reprocess-saved-results.mjs","line":305,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/reprocess-saved-results.mjs:305"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/reprocess-saved-results.mjs","line":499,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/reprocess-saved-results.mjs:499"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/reprocess-saved-results.mjs","line":499,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/reprocess-saved-results.mjs:499"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/server/providerStore.mjs","line":44,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/server/providerStore.mjs:44"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/server/providerStore.mjs","line":44,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/server/providerStore.mjs:44"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/server/runtime.mjs","line":221,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/server/runtime.mjs:221"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/server/runtime.mjs","line":221,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/server/runtime.mjs:221"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/server/testHarness.mjs","line":12,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/server/testHarness.mjs:12"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/update-saved-results.mjs","line":332,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/update-saved-results.mjs:332"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"scripts/update-saved-results.mjs","line":332,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:scripts/update-saved-results.mjs:332"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/domain/passes.ts","line":10,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/domain/passes.ts:10"},{"rule_id":"opengrep/javascript.lang.correctness.missing-template-string-indicator","severity":"low","message":"This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'?","path":"src/domain/passes.ts","line":10,"fingerprint":"javascript.lang.correctness.missing-template-string-indicator:src/domain/passes.ts:10"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":0.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":9014.0,"source_lines":13285.0,"test_ratio":0.6785,"ci_files":0.0,"cochange_share":0.8824,"cochange_commits":68.0},"findings":[],"evidence":[],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":0.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":334.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":1.0,"check:low_escape_density":1.0,"escapes":0.0,"escapes_per_kloc":0.0},"findings":[],"evidence":[{"kind":"typing","description":"TypeScript strict type checking: tsconfig.json","ref":"tsconfig.json","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":550.0,"other_lines":12735.0,"files_blamed":61.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":35.0,"quality:other_per_kloc":2.748,"quality:ratio":0.0,"security:ai_findings":1.0,"security:ai_per_kloc":1.818,"security:other_findings":9.0,"security:other_per_kloc":0.707,"security:ratio":2.57},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}