{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T16:33:53.003641Z","repo":{"ref":{"host":"github.com","owner":"MetrolistGroup","name":"Metrolist"},"default_branch":"main","clone_url":"https://github.com/MetrolistGroup/Metrolist.git","html_url":"https://github.com/MetrolistGroup/Metrolist","description":"YouTube Music client for Android","stars":14277,"forks":1306,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":140959,"primary_language":"Kotlin","license_spdx":"GPL-3.0","created_at":"2023-08-11T12:19:23Z","pushed_at":"2026-11-14T16:31:37Z","security_policy_url":"https://github.com/MetrolistGroup/Metrolist/security/policy","distribution":{"owner_created_at":"2026-02-07T13:40:00Z","owner_type":"Organization","release_assets":[{"name":"metrolist-altstore.json","size":771,"download_count":239,"release_tag":"v14.0.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v14.0.0/metrolist-altstore.json"},{"name":"metrolist-desktop-linux-arm64-14.0.0.AppImage","size":164059656,"download_count":149,"release_tag":"v14.0.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v14.0.0/metrolist-desktop-linux-arm64-14.0.0.AppImage"},{"name":"metrolist-desktop-linux-x64-14.0.0.AppImage","size":165464568,"download_count":489,"release_tag":"v14.0.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v14.0.0/metrolist-desktop-linux-x64-14.0.0.AppImage"},{"name":"metrolist-desktop-macos-arm64-14.0.0.dmg","size":118851871,"download_count":83,"release_tag":"v14.0.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v14.0.0/metrolist-desktop-macos-arm64-14.0.0.dmg"},{"name":"metrolist-desktop-macos-x64-14.0.0.dmg","size":125005583,"download_count":38,"release_tag":"v14.0.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v14.0.0/metrolist-desktop-macos-x64-14.0.0.dmg"},{"name":"metrolist-desktop-windows-arm64-14.0.0.zip","size":213014340,"download_count":118,"release_tag":"v14.0.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v14.0.0/metrolist-desktop-windows-arm64-14.0.0.zip"},{"name":"Metrolist-Desktop-windows.zip","size":196406623,"download_count":1296,"release_tag":"v14.0.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v14.0.0/Metrolist-Desktop-windows.zip"},{"name":"metrolist-installer-windows-x64-14.0.0.exe","size":10581504,"download_count":986,"release_tag":"v14.0.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v14.0.0/metrolist-installer-windows-x64-14.0.0.exe"},{"name":"Metrolist-KMP-mapping.txt","size":347670511,"download_count":58,"release_tag":"v14.0.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v14.0.0/Metrolist-KMP-mapping.txt"},{"name":"Metrolist-with-Google-Cast.apk","size":14530892,"download_count":12531,"release_tag":"v14.0.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v14.0.0/Metrolist-with-Google-Cast.apk"},{"name":"Metrolist.apk","size":14530892,"download_count":25890,"release_tag":"v14.0.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v14.0.0/Metrolist.apk"},{"name":"Metrolist.ipa","size":53256709,"download_count":236,"release_tag":"v14.0.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v14.0.0/Metrolist.ipa"},{"name":"SHA256SUMS","size":1187,"download_count":29,"release_tag":"v14.0.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v14.0.0/SHA256SUMS"},{"name":"Metrolist-with-Google-Cast.apk","size":25630024,"download_count":8830,"release_tag":"nightly","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/nightly/Metrolist-with-Google-Cast.apk"},{"name":"Metrolist-izzy.apk","size":26868210,"download_count":61939,"release_tag":"v13.7.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.7.0/Metrolist-izzy.apk"},{"name":"Metrolist-with-Google-Cast.apk","size":28479899,"download_count":216731,"release_tag":"v13.7.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.7.0/Metrolist-with-Google-Cast.apk"},{"name":"Metrolist.apk","size":26872306,"download_count":938065,"release_tag":"v13.7.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.7.0/Metrolist.apk"},{"name":"Metrolist-izzy.apk","size":24142299,"download_count":54941,"release_tag":"v13.6.3","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.6.3/Metrolist-izzy.apk"},{"name":"Metrolist-with-Google-Cast.apk","size":25774469,"download_count":182529,"release_tag":"v13.6.3","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.6.3/Metrolist-with-Google-Cast.apk"},{"name":"Metrolist.apk","size":24146395,"download_count":683835,"release_tag":"v13.6.3","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.6.3/Metrolist.apk"},{"name":"Metrolist-izzy.apk","size":24175067,"download_count":511,"release_tag":"v13.6.2","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.6.2/Metrolist-izzy.apk"},{"name":"Metrolist-with-Google-Cast.apk","size":25807237,"download_count":3529,"release_tag":"v13.6.2","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.6.2/Metrolist-with-Google-Cast.apk"},{"name":"Metrolist.apk","size":24179163,"download_count":16240,"release_tag":"v13.6.2","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.6.2/Metrolist.apk"},{"name":"Metrolist-izzy.apk","size":24109601,"download_count":22875,"release_tag":"v13.6.1","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.6.1/Metrolist-izzy.apk"},{"name":"Metrolist-with-Google-Cast.apk","size":25741771,"download_count":138529,"release_tag":"v13.6.1","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.6.1/Metrolist-with-Google-Cast.apk"},{"name":"Metrolist.apk","size":24113697,"download_count":404488,"release_tag":"v13.6.1","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.6.1/Metrolist.apk"},{"name":"Metrolist-izzy.apk","size":25190946,"download_count":30188,"release_tag":"v13.6.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.6.0/Metrolist-izzy.apk"},{"name":"Metrolist-with-Google-Cast.apk","size":26839674,"download_count":129455,"release_tag":"v13.6.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.6.0/Metrolist-with-Google-Cast.apk"},{"name":"Metrolist.apk","size":25195042,"download_count":443622,"release_tag":"v13.6.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.6.0/Metrolist.apk"},{"name":"Metrolist-izzy.apk","size":23986111,"download_count":20222,"release_tag":"v13.5.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.5.0/Metrolist-izzy.apk"},{"name":"Metrolist-with-Google-Cast.apk","size":41162947,"download_count":101794,"release_tag":"v13.5.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.5.0/Metrolist-with-Google-Cast.apk"},{"name":"Metrolist.apk","size":23990207,"download_count":387457,"release_tag":"v13.5.0","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.5.0/Metrolist.apk"},{"name":"Metrolist-izzy.apk","size":23982002,"download_count":21715,"release_tag":"v13.4.3","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.4.3/Metrolist-izzy.apk"},{"name":"Metrolist-with-Google-Cast.apk","size":25626634,"download_count":115352,"release_tag":"v13.4.3","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.4.3/Metrolist-with-Google-Cast.apk"},{"name":"Metrolist.apk","size":23982002,"download_count":366186,"release_tag":"v13.4.3","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.4.3/Metrolist.apk"},{"name":"Metrolist-izzy.apk","size":23940885,"download_count":32463,"release_tag":"v13.4.2","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.4.2/Metrolist-izzy.apk"},{"name":"Metrolist-with-Google-Cast.apk","size":25638765,"download_count":114755,"release_tag":"v13.4.2","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.4.2/Metrolist-with-Google-Cast.apk"},{"name":"Metrolist.apk","size":23957269,"download_count":441523,"release_tag":"v13.4.2","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v13.4.2/Metrolist.apk"}]}},"commit_sha":"7d98d60dd317e703204ec58b35e72f26fffc3ee4","profile":{"lines_by_language":{"Kotlin":503351,"JavaScript":10173,"Python":6599,"Java":975,"Shell":537,"C++":362,"C#":326,"Swift":162,"PowerShell":111,"SQL":54},"files_by_category":{"source":2248,"config":292,"test":192,"docs":133,"other":60,"binary":54,"oversized":4},"source_lines":492007,"test_lines":30643},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.72,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":2.0,"flagged_work_units":0.0,"flagged_releases":0.0,"style_index":0.012},"summary":"Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals."},"quality":{"score":72.8,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":58.4,"duplication":60.3,"lint":98.4,"testing":78.1,"docs":85.0,"type_safety":40.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.06, CI runs tests; 18% of function code in complex or long functions; 8% duplicated lines. Weakest area: type safety."},"security":{"score":56.3,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":6.5,"sast":96.5,"dependencies":100.0,"ci_actions":38.0,"posture":40.0,"scorecard":null},"summary":"Security posture is weak: 2 possible secret(s) in the tree, 9 only in history; 36 high-severity SAST findings; 3 high-severity workflow issues. Weakest area: secrets."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":1.0,"checked":1.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":10.0,"attributed_commits":3.0,"attributed_commit_share":0.3,"effective_loc":522681.0,"attributed_loc":1.0,"attributed_loc_share":1.9132128391887213e-6,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 3 attributed commits, 1 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"216442e93ad4fb6c5252974d253ce6df70e5538d","url":"https://github.com/MetrolistGroup/Metrolist/commit/216442e93ad4fb6c5252974d253ce6df70e5538d","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"8fe84ad68c31fe8f2330fc5f93f9d051d8947af6","url":"https://github.com/MetrolistGroup/Metrolist/commit/8fe84ad68c31fe8f2330fc5f93f9d051d8947af6","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: message 'claude.ai/code'","ref":"8eb76b6c6baed617036e976b290502bf4eb2c557","url":"https://github.com/MetrolistGroup/Metrolist/commit/8eb76b6c6baed617036e976b290502bf4eb2c557","weight":0.9}],"data":{"attributed_loc_by_commit":{"8eb76b6c6baed617036e976b290502bf4eb2c557":0,"8fe84ad68c31fe8f2330fc5f93f9d051d8947af6":1,"216442e93ad4fb6c5252974d253ce6df70e5538d":0},"tools":{"claude-code":{"name":"Claude Code","commits":3,"loc":1,"first_seen":1794664575,"last_seen":1794664837}},"monthly":{"2026-11":{"loc":522681,"attributed_loc":1}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":2.0,"workflow_agents":0.0,"tools_configured":2.0,"earliest_adoption":1794660398.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/CLAUDE.md","weight":0.5},{"kind":"ai-artifact","description":"AGENTS.md (generic-agent configuration)","ref":"AGENTS.md","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/AGENTS.md","weight":0.5}],"data":{"artifacts":[{"tool":"claude-code","path":"CLAUDE.md","added_at":1794660398},{"tool":"generic-agent","path":"AGENTS.md","added_at":1794660398}],"workflows":[],"tools":["claude-code","generic-agent"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"work_units":3.0,"flagged_units":0.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":88.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":15.0,"median_loc_per_hour":0.0,"pr_timed_units":0.0,"excluded_import_loc":522593.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["6f7351ca5a83864e4d3fa2632e08341fe3910730"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"releases":0.0,"flagged_releases":0.0,"max_loc_per_day":0.0},"findings":[],"evidence":[],"data":{"releases":[]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":492007.0,"index":0.012,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":12.0,"per_kloc:emoji_in_code":0.024,"files:emoji_in_code":6.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":2.0,"secrets_history":9.0,"secrets_nonprod":0.0,"secrets_low_confidence":12.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"shared/src/androidMain/kotlin/com/metrolist/shared/youtube/playback/BotGuardPoTokenMinter.kt","line":401,"fingerprint":"shared/src/androidMain/kotlin/com/metrolist/shared/youtube/playback/BotGuardPoTokenMinter.kt:generic-api-key:401"},{"rule_id":"gitleaks/gcp-api-key","severity":"high","message":"Possible gcp-api-key secret in the current tree","path":"shared/src/androidMain/kotlin/com/metrolist/shared/youtube/playback/BotGuardPoTokenMinter.kt","line":404,"fingerprint":"shared/src/androidMain/kotlin/com/metrolist/shared/youtube/playback/BotGuardPoTokenMinter.kt:gcp-api-key:404"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"shared/src/commonTest/kotlin/com/metrolist/shared/api/lyrics/LyprioLyricsProviderTest.kt","line":967,"fingerprint":"shared/src/commonTest/kotlin/com/metrolist/shared/api/lyrics/LyprioLyricsProviderTest.kt:generic-api-key:967"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree","path":"shared/src/commonMain/kotlin/com/metrolist/shared/youtube/playback/PageBoundPoTokenMinter.kt","line":62,"fingerprint":"shared/src/commonMain/kotlin/com/metrolist/shared/youtube/playback/PageBoundPoTokenMinter.kt:generic-api-key:62"},{"rule_id":"gitleaks/gcp-api-key","severity":"high","message":"Possible gcp-api-key secret in the current tree","path":"shared/src/commonMain/kotlin/com/metrolist/shared/youtube/playback/PageBoundPoTokenMinter.kt","line":63,"fingerprint":"shared/src/commonMain/kotlin/com/metrolist/shared/youtube/playback/PageBoundPoTokenMinter.kt:gcp-api-key:63"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit bca805962f); removed from the current tree but still retrievable","path":"innertube/src/main/kotlin/com/metrolist/innertube/InnerTube.kt","line":787,"fingerprint":"bca805962fa42b4f8426e23af0a9ffd0824c44ba:innertube/src/main/kotlin/com/metrolist/innertube/InnerTube.kt:generic-api-key:787"},{"rule_id":"gitleaks/gcp-api-key","severity":"medium","message":"Possible gcp-api-key secret in history (commit 9811666904); removed from the current tree but still retrievable","path":"app/src/main/kotlin/com/metrolist/music/utils/potoken/PoTokenWebView.kt","line":325,"fingerprint":"98116669042d8e41d6cfbe764de3c6948d362bea:app/src/main/kotlin/com/metrolist/music/utils/potoken/PoTokenWebView.kt:gcp-api-key:325"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 9811666904); removed from the current tree but still retrievable","path":"app/src/main/kotlin/com/metrolist/music/utils/potoken/PoTokenWebView.kt","line":326,"fingerprint":"98116669042d8e41d6cfbe764de3c6948d362bea:app/src/main/kotlin/com/metrolist/music/utils/potoken/PoTokenWebView.kt:generic-api-key:326"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 489b2a6b0c); removed from the current tree but still retrievable","path":"app/src/main/cpp/coverart/bento4/Source/Python/utils/wv-request.py","line":13,"fingerprint":"489b2a6b0ce422017ee7198c2c76684e8ab91718:app/src/main/cpp/coverart/bento4/Source/Python/utils/wv-request.py:generic-api-key:13"},{"rule_id":"gitleaks/gcp-api-key","severity":"medium","message":"Possible gcp-api-key secret in history (commit aae4bd8fab); removed from the current tree but still retrievable","path":"app/src/main/java/com/metrolist/music/utils/potoken/PoTokenWebView.kt","line":318,"fingerprint":"aae4bd8fab1d8d48a96823ae8bbe7016e2979983:app/src/main/java/com/metrolist/music/utils/potoken/PoTokenWebView.kt:gcp-api-key:318"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit aae4bd8fab); removed from the current tree but still retrievable","path":"app/src/main/java/com/metrolist/music/utils/potoken/PoTokenWebView.kt","line":319,"fingerprint":"aae4bd8fab1d8d48a96823ae8bbe7016e2979983:app/src/main/java/com/metrolist/music/utils/potoken/PoTokenWebView.kt:generic-api-key:319"},{"rule_id":"gitleaks/gcp-api-key","severity":"medium","message":"Possible gcp-api-key secret in history (commit 026a1a4a91); removed from the current tree but still retrievable","path":"innertube/src/main/java/com/metrolist/innertube/models/YouTubeClient.kt","line":57,"fingerprint":"026a1a4a919ffbe4833aa10259b874d64570bddd:innertube/src/main/java/com/metrolist/innertube/models/YouTubeClient.kt:gcp-api-key:57"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 1804fb0798); removed from the current tree but still retrievable","path":"innertube/src/main/java/com/metrolist/innertube/InnerTube.kt","line":253,"fingerprint":"1804fb07986e32b797be8fdb14930b7b6ad1e616:innertube/src/main/java/com/metrolist/innertube/InnerTube.kt:generic-api-key:253"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 1804fb0798); removed from the current tree but still retrievable","path":"innertube/src/main/java/com/metrolist/innertube/models/YouTubeClient.kt","line":53,"fingerprint":"1804fb07986e32b797be8fdb14930b7b6ad1e616:innertube/src/main/java/com/metrolist/innertube/models/YouTubeClient.kt:generic-api-key:53"},{"rule_id":"gitleaks/gcp-api-key","severity":"medium","message":"Possible gcp-api-key secret in history (commit f0c5fd1e8b); removed from the current tree but still retrievable","path":"innertube/src/main/java/com/malopieds/innertube/models/YouTubeClient.kt","line":37,"fingerprint":"f0c5fd1e8b90b91e418972bdf5bc9fa74d461732:innertube/src/main/java/com/malopieds/innertube/models/YouTubeClient.kt:gcp-api-key:37"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit f0c5fd1e8b); removed from the current tree but still retrievable","path":"innertube/src/main/java/com/malopieds/innertube/models/YouTubeClient.kt","line":53,"fingerprint":"f0c5fd1e8b90b91e418972bdf5bc9fa74d461732:innertube/src/main/java/com/malopieds/innertube/models/YouTubeClient.kt:generic-api-key:53"},{"rule_id":"gitleaks/gcp-api-key","severity":"medium","message":"Possible gcp-api-key secret in history (commit 8b67ac6221); removed from the current tree but still retrievable","path":"innertube/src/main/java/com/zionhuang/innertube/models/YouTubeClient.kt","line":61,"fingerprint":"8b67ac622164c19db5dc7ea6ed5b0697f52b4f1b:innertube/src/main/java/com/zionhuang/innertube/models/YouTubeClient.kt:gcp-api-key:61"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit dd00b3d03a); removed from the current tree but still retrievable","path":"innertube/src/main/java/com/zionhuang/innertube/InnerTube.kt","line":210,"fingerprint":"dd00b3d03a8173c53bde1163d1dc14a24c1ad487:innertube/src/main/java/com/zionhuang/innertube/InnerTube.kt:generic-api-key:210"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit dd00b3d03a); removed from the current tree but still retrievable","path":"innertube/src/main/java/com/zionhuang/innertube/models/YouTubeClient.kt","line":46,"fingerprint":"dd00b3d03a8173c53bde1163d1dc14a24c1ad487:innertube/src/main/java/com/zionhuang/innertube/models/YouTubeClient.kt:generic-api-key:46"},{"rule_id":"gitleaks/gcp-api-key","severity":"medium","message":"Possible gcp-api-key secret in history (commit 43fe41e3c8); removed from the current tree but still retrievable","path":"app/src/main/java/com/zionhuang/music/extractor/ytextractors/YouTubeSearchExtractor.kt","line":45,"fingerprint":"43fe41e3c86bebb505aafef72feb51347fdd074b:app/src/main/java/com/zionhuang/music/extractor/ytextractors/YouTubeSearchExtractor.kt:gcp-api-key:45"},{"rule_id":"gitleaks/gcp-api-key","severity":"medium","message":"Possible gcp-api-key secret in history (commit aea1d793df); removed from the current tree but still retrievable","path":"app/src/main/java/com/zionhuang/music/extractor/YouTubeExtractor.kt","line":486,"fingerprint":"aea1d793df1423958aa7cde4686971a132b1a1cd:app/src/main/java/com/zionhuang/music/extractor/YouTubeExtractor.kt:gcp-api-key:486"},{"rule_id":"gitleaks/gcp-api-key","severity":"medium","message":"Possible gcp-api-key secret in history (commit 001945eccb); removed from the current tree but still retrievable","path":"app/src/main/java/com/zionhuang/music/youtube/extractors/YouTubeSearchExtractor.kt","line":13,"fingerprint":"001945eccb8cfac839dccd1f9a9a2ddf65c6bf86:app/src/main/java/com/zionhuang/music/youtube/extractors/YouTubeSearchExtractor.kt:gcp-api-key:13"},{"rule_id":"gitleaks/gcp-api-key","severity":"medium","message":"Possible gcp-api-key secret in history (commit bc47e673cd); removed from the current tree but still retrievable","path":"app/src/main/java/com/zionhuang/music/SearchResultFragment.java","line":126,"fingerprint":"bc47e673cd1db6b904587b34d3c7578fa4c19385:app/src/main/java/com/zionhuang/music/SearchResultFragment.java:gcp-api-key:126"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":90.0,"findings_high":36.0,"findings_medium":46.0,"findings_low":8.0,"weighted_findings":50.2,"scanned_lines":491842.0,"parse_errors":20.0},"findings":[{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"scripts/check_compose_resource_escapes.py","line":9,"fingerprint":"python.lang.security.use-defused-xml:scripts/check_compose_resource_escapes.py:9"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"scripts/check_translation_mechanics.py","line":8,"fingerprint":"python.lang.security.use-defused-xml:scripts/check_translation_mechanics.py:8"},{"rule_id":"opengrep/python.lang.security.use-defused-xml-parse","severity":"high","message":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`. [confidence medium]","path":"scripts/check_translation_mechanics.py","line":114,"fingerprint":"python.lang.security.use-defused-xml-parse:scripts/check_translation_mechanics.py:114"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/desktop-native-image/benchmark.py","line":54,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/desktop-native-image/benchmark.py:54"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-tainted-env-args","severity":"high","message":"Detected subprocess function 'run' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.quote()'. [confidence medium]","path":"scripts/desktop-native-image/benchmark.py","line":54,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-tainted-env-args:scripts/desktop-native-image/benchmark.py:54"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/desktop-native-image/measure-build.py","line":17,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/desktop-native-image/measure-build.py:17"},{"rule_id":"opengrep/python.lang.security.audit.subprocess-shell-true","severity":"high","message":"Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead. [confidence medium]","path":"scripts/desktop-native-image/measure-build.py","line":17,"fingerprint":"python.lang.security.audit.subprocess-shell-true:scripts/desktop-native-image/measure-build.py:17"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/desktop-native-image/measure-build.py","line":19,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/desktop-native-image/measure-build.py:19"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/desktop-native-image/native_image.py","line":87,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/desktop-native-image/native_image.py:87"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/desktop-native-image/native_image.py","line":93,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/desktop-native-image/native_image.py:93"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/desktop-native-image/native_image.py","line":151,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/desktop-native-image/native_image.py:151"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/desktop-native-image/run.py","line":224,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/desktop-native-image/run.py:224"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/desktop_smoke.py","line":117,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/desktop_smoke.py:117"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/desktop_smoke.py","line":142,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/desktop_smoke.py:142"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/desktop_smoke.py","line":196,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/desktop_smoke.py:196"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/desktop_smoke.py","line":264,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/desktop_smoke.py:264"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/desktop_smoke.py","line":313,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/desktop_smoke.py:313"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"scripts/find_unused_strings.py","line":17,"fingerprint":"python.lang.security.use-defused-xml:scripts/find_unused_strings.py:17"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"scripts/find_unused_strings.py","line":18,"fingerprint":"python.lang.security.use-defused-xml:scripts/find_unused_strings.py:18"},{"rule_id":"opengrep/python.lang.security.use-defused-xml-parse","severity":"high","message":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`. [confidence medium]","path":"scripts/find_unused_strings.py","line":30,"fingerprint":"python.lang.security.use-defused-xml-parse:scripts/find_unused_strings.py:30"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"scripts/generate_distribution.py","line":14,"fingerprint":"python.lang.security.use-defused-xml:scripts/generate_distribution.py:14"},{"rule_id":"opengrep/python.lang.security.use-defused-xml-parse","severity":"high","message":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`. [confidence medium]","path":"scripts/generate_distribution.py","line":88,"fingerprint":"python.lang.security.use-defused-xml-parse:scripts/generate_distribution.py:88"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"scripts/generate_material_symbols.py","line":20,"fingerprint":"python.lang.security.use-defused-xml:scripts/generate_material_symbols.py:20"},{"rule_id":"opengrep/python.lang.security.use-defused-xml","severity":"high","message":"The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and \"XML bombs\" can cause denial of service. [confidence low]","path":"scripts/propose_distribution.py","line":11,"fingerprint":"python.lang.security.use-defused-xml:scripts/propose_distribution.py:11"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'check_output' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/propose_distribution.py","line":17,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/propose_distribution.py:17"},{"rule_id":"opengrep/python.lang.security.use-defused-xml-parse","severity":"high","message":"The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and \"XML bombs\" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`. [confidence medium]","path":"scripts/propose_distribution.py","line":36,"fingerprint":"python.lang.security.use-defused-xml-parse:scripts/propose_distribution.py:36"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"scripts/verify_linux_credentials.py","line":32,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:scripts/verify_linux_credentials.py:32"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"shared/src/commonMain/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectPeerPolicy.kt","line":68,"fingerprint":"javascript.lang.security.detect-insecure-websocket:shared/src/commonMain/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectPeerPolicy.kt:68"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"shared/src/commonTest/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectUrlTest.kt","line":41,"fingerprint":"javascript.lang.security.detect-insecure-websocket:shared/src/commonTest/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectUrlTest.kt:41"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"shared/src/commonTest/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectUrlTest.kt","line":54,"fingerprint":"javascript.lang.security.detect-insecure-websocket:shared/src/commonTest/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectUrlTest.kt:54"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"shared/src/commonTest/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectUrlTest.kt","line":59,"fingerprint":"javascript.lang.security.detect-insecure-websocket:shared/src/commonTest/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectUrlTest.kt:59"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"shared/src/commonTest/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectUrlTest.kt","line":64,"fingerprint":"javascript.lang.security.detect-insecure-websocket:shared/src/commonTest/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectUrlTest.kt:64"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"shared/src/commonTest/kotlin/com/metrolist/shared/listentogether/network/ListenTogetherServerUrlPolicyTest.kt","line":16,"fingerprint":"javascript.lang.security.detect-insecure-websocket:shared/src/commonTest/kotlin/com/metrolist/shared/listentogether/network/ListenTogetherServerUrlPolicyTest.kt:16"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"shared/src/commonTest/kotlin/com/metrolist/shared/listentogether/network/ListenTogetherServerUrlPolicyTest.kt","line":17,"fingerprint":"javascript.lang.security.detect-insecure-websocket:shared/src/commonTest/kotlin/com/metrolist/shared/listentogether/network/ListenTogetherServerUrlPolicyTest.kt:17"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"shared/src/commonTest/kotlin/com/metrolist/shared/listentogether/network/ListenTogetherServerUrlPolicyTest.kt","line":18,"fingerprint":"javascript.lang.security.detect-insecure-websocket:shared/src/commonTest/kotlin/com/metrolist/shared/listentogether/network/ListenTogetherServerUrlPolicyTest.kt:18"},{"rule_id":"opengrep/javascript.lang.security.detect-insecure-websocket","severity":"high","message":"Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections. [confidence low]","path":"shared/src/commonTest/kotlin/com/metrolist/shared/listentogether/network/ListenTogetherServerUrlPolicyTest.kt","line":19,"fingerprint":"javascript.lang.security.detect-insecure-websocket:shared/src/commonTest/kotlin/com/metrolist/shared/listentogether/network/ListenTogetherServerUrlPolicyTest.kt:19"},{"rule_id":"opengrep/javascript.lang.security.audit.detect-non-literal-regexp","severity":"medium","message":"RegExp() called with a `{ github, context }` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on  [confidence low]","path":".github/scripts/reporter-labels.cjs","line":15,"fingerprint":"javascript.lang.security.audit.detect-non-literal-regexp:.github/scripts/reporter-labels.cjs:15"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"androidApp/src/main/AndroidManifest.xml","line":101,"fingerprint":"java.android.security.exported_activity:androidApp/src/main/AndroidManifest.xml:101"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"androidApp/src/main/AndroidManifest.xml","line":229,"fingerprint":"java.android.security.exported_activity:androidApp/src/main/AndroidManifest.xml:229"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"androidApp/src/main/AndroidManifest.xml","line":247,"fingerprint":"java.android.security.exported_activity:androidApp/src/main/AndroidManifest.xml:247"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"androidApp/src/main/AndroidManifest.xml","line":265,"fingerprint":"java.android.security.exported_activity:androidApp/src/main/AndroidManifest.xml:265"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"androidApp/src/main/AndroidManifest.xml","line":283,"fingerprint":"java.android.security.exported_activity:androidApp/src/main/AndroidManifest.xml:283"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"androidApp/src/main/AndroidManifest.xml","line":301,"fingerprint":"java.android.security.exported_activity:androidApp/src/main/AndroidManifest.xml:301"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"androidApp/src/main/AndroidManifest.xml","line":319,"fingerprint":"java.android.security.exported_activity:androidApp/src/main/AndroidManifest.xml:319"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"androidApp/src/main/AndroidManifest.xml","line":337,"fingerprint":"java.android.security.exported_activity:androidApp/src/main/AndroidManifest.xml:337"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"androidApp/src/main/AndroidManifest.xml","line":355,"fingerprint":"java.android.security.exported_activity:androidApp/src/main/AndroidManifest.xml:355"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"androidApp/src/main/AndroidManifest.xml","line":373,"fingerprint":"java.android.security.exported_activity:androidApp/src/main/AndroidManifest.xml:373"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"androidApp/src/main/AndroidManifest.xml","line":391,"fingerprint":"java.android.security.exported_activity:androidApp/src/main/AndroidManifest.xml:391"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"androidApp/src/main/AndroidManifest.xml","line":409,"fingerprint":"java.android.security.exported_activity:androidApp/src/main/AndroidManifest.xml:409"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"androidApp/src/main/AndroidManifest.xml","line":427,"fingerprint":"java.android.security.exported_activity:androidApp/src/main/AndroidManifest.xml:427"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"androidApp/src/main/AndroidManifest.xml","line":579,"fingerprint":"java.android.security.exported_activity:androidApp/src/main/AndroidManifest.xml:579"},{"rule_id":"opengrep/bash.curl.security.curl-pipe-bash","severity":"medium","message":"Data is being piped into `bash` from a `curl` command. An attacker with control of the server in the `curl` command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into `bash` or any other shell if you can. If you must do this, consider checki [confidence low]","path":"scripts/deps.sh","line":26,"fingerprint":"bash.curl.security.curl-pipe-bash:scripts/deps.sh:26"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/desktop-native-image/toolchain.py","line":42,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/desktop-native-image/toolchain.py:42"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/generate_mandarin_table.py","line":23,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/generate_mandarin_table.py:23"},{"rule_id":"opengrep/python.lang.security.audit.dynamic-urllib-use-detected","severity":"medium","message":"Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead. [confidence low]","path":"scripts/generate_material_symbols.py","line":97,"fingerprint":"python.lang.security.audit.dynamic-urllib-use-detected:scripts/generate_material_symbols.py:97"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/desktopTest/kotlin/com/metrolist/shared/cast/CastProtocolTest.kt","line":166,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/desktopTest/kotlin/com/metrolist/shared/cast/CastProtocolTest.kt:166"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/desktopTest/kotlin/com/metrolist/shared/cast/CastProtocolTest.kt","line":174,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/desktopTest/kotlin/com/metrolist/shared/cast/CastProtocolTest.kt:174"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/desktopTest/kotlin/com/metrolist/shared/cast/CastProtocolTest.kt","line":225,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/desktopTest/kotlin/com/metrolist/shared/cast/CastProtocolTest.kt:225"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/desktopTest/kotlin/com/metrolist/shared/cast/CastProtocolTest.kt","line":226,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/desktopTest/kotlin/com/metrolist/shared/cast/CastProtocolTest.kt:226"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/desktopTest/kotlin/com/metrolist/shared/cast/CastProtocolTest.kt","line":426,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/desktopTest/kotlin/com/metrolist/shared/cast/CastProtocolTest.kt:426"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/desktopTest/kotlin/com/metrolist/shared/cast/DlnaSessionTest.kt","line":236,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/desktopTest/kotlin/com/metrolist/shared/cast/DlnaSessionTest.kt:236"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/desktopTest/kotlin/com/metrolist/shared/cast/DlnaSessionTest.kt","line":240,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/desktopTest/kotlin/com/metrolist/shared/cast/DlnaSessionTest.kt:240"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/desktopTest/kotlin/com/metrolist/shared/cast/FcastSessionTest.kt","line":27,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/desktopTest/kotlin/com/metrolist/shared/cast/FcastSessionTest.kt:27"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/desktopTest/kotlin/com/metrolist/shared/cast/FcastSessionTest.kt","line":85,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/desktopTest/kotlin/com/metrolist/shared/cast/FcastSessionTest.kt:85"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectManagerShutdownTest.kt","line":261,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectManagerShutdownTest.kt:261"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt","line":66,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt:66"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt","line":71,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt:71"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt","line":78,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt:78"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt","line":83,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt:83"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt","line":95,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt:95"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt","line":101,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt:101"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt","line":102,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt:102"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt","line":109,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/desktopTest/kotlin/com/metrolist/shared/deviceconnect/LocalDeviceServerTest.kt:109"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"shared/src/iosMain/resources/kuromoji.js","line":482,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:shared/src/iosMain/resources/kuromoji.js:482"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-dynamic-method","severity":"medium","message":"Using non-static data to retrieve and run functions from the object is dangerous. If the data is user-controlled, it may allow executing arbitrary code. [confidence low]","path":"shared/src/iosMain/resources/kuromoji.js","line":2899,"fingerprint":"javascript.lang.security.audit.unsafe-dynamic-method:shared/src/iosMain/resources/kuromoji.js:2899"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"shared/src/iosMain/resources/kuromoji.js","line":8197,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:shared/src/iosMain/resources/kuromoji.js:8197"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"shared/src/iosMain/resources/kuromoji.js","line":8217,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:shared/src/iosMain/resources/kuromoji.js:8217"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"shared/src/iosMain/resources/kuromoji.js","line":8249,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:shared/src/iosMain/resources/kuromoji.js:8249"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/jvmSharedMain/kotlin/com/metrolist/shared/cast/CastProxyServer.kt","line":98,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/jvmSharedMain/kotlin/com/metrolist/shared/cast/CastProxyServer.kt:98"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/jvmSharedMain/kotlin/com/metrolist/shared/cast/CastProxyServer.kt","line":99,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/jvmSharedMain/kotlin/com/metrolist/shared/cast/CastProxyServer.kt:99"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/jvmSharedMain/kotlin/com/metrolist/shared/cast/DlnaSession.kt","line":407,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/jvmSharedMain/kotlin/com/metrolist/shared/cast/DlnaSession.kt:407"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"shared/src/jvmSharedMain/kotlin/com/metrolist/shared/cast/FcastSession.kt","line":59,"fingerprint":"kotlin.lang.security.unencrypted-socket:shared/src/jvmSharedMain/kotlin/com/metrolist/shared/cast/FcastSession.kt:59"},{"rule_id":"opengrep/kotlin.lang.security.gcm-detection","severity":"low","message":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not n [confidence low]","path":"shared/src/androidMain/kotlin/com/metrolist/shared/discord/DiscordTokenStore.android.kt","line":152,"fingerprint":"kotlin.lang.security.gcm-detection:shared/src/androidMain/kotlin/com/metrolist/shared/discord/DiscordTokenStore.android.kt:152"},{"rule_id":"opengrep/kotlin.lang.security.gcm-detection","severity":"low","message":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not n [confidence low]","path":"shared/src/androidMain/kotlin/com/metrolist/shared/discord/DiscordTokenStore.android.kt","line":172,"fingerprint":"kotlin.lang.security.gcm-detection:shared/src/androidMain/kotlin/com/metrolist/shared/discord/DiscordTokenStore.android.kt:172"},{"rule_id":"opengrep/kotlin.lang.security.gcm-detection","severity":"low","message":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not n [confidence low]","path":"shared/src/androidMain/kotlin/com/metrolist/shared/discord/DiscordTokenStore.android.kt","line":173,"fingerprint":"kotlin.lang.security.gcm-detection:shared/src/androidMain/kotlin/com/metrolist/shared/discord/DiscordTokenStore.android.kt:173"},{"rule_id":"opengrep/kotlin.lang.security.gcm-detection","severity":"low","message":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not n [confidence low]","path":"shared/src/androidMain/kotlin/com/metrolist/shared/settings/AndroidSecureSettings.kt","line":159,"fingerprint":"kotlin.lang.security.gcm-detection:shared/src/androidMain/kotlin/com/metrolist/shared/settings/AndroidSecureSettings.kt:159"},{"rule_id":"opengrep/kotlin.lang.security.gcm-detection","severity":"low","message":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not n [confidence low]","path":"shared/src/jvmSharedMain/kotlin/com/metrolist/shared/deviceconnect/DeviceCrypto.jvm.kt","line":67,"fingerprint":"kotlin.lang.security.gcm-detection:shared/src/jvmSharedMain/kotlin/com/metrolist/shared/deviceconnect/DeviceCrypto.jvm.kt:67"},{"rule_id":"opengrep/kotlin.lang.security.gcm-detection","severity":"low","message":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not n [confidence low]","path":"shared/src/jvmSharedMain/kotlin/com/metrolist/shared/deviceconnect/DeviceCrypto.jvm.kt","line":68,"fingerprint":"kotlin.lang.security.gcm-detection:shared/src/jvmSharedMain/kotlin/com/metrolist/shared/deviceconnect/DeviceCrypto.jvm.kt:68"},{"rule_id":"opengrep/kotlin.lang.security.gcm-detection","severity":"low","message":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not n [confidence low]","path":"shared/src/jvmSharedMain/kotlin/com/metrolist/shared/deviceconnect/DeviceCrypto.jvm.kt","line":82,"fingerprint":"kotlin.lang.security.gcm-detection:shared/src/jvmSharedMain/kotlin/com/metrolist/shared/deviceconnect/DeviceCrypto.jvm.kt:82"},{"rule_id":"opengrep/kotlin.lang.security.gcm-detection","severity":"low","message":"GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not n [confidence low]","path":"shared/src/jvmSharedMain/kotlin/com/metrolist/shared/deviceconnect/DeviceCrypto.jvm.kt","line":83,"fingerprint":"kotlin.lang.security.gcm-detection:shared/src/jvmSharedMain/kotlin/com/metrolist/shared/deviceconnect/DeviceCrypto.jvm.kt:83"}],"evidence":[],"data":{"rulesets":["kotlin","javascript","python","java","bash","csharp","c","swift"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":0.0,"vulnerabilities":0.0,"vulns_critical":0.0,"vulns_high":0.0,"vulns_medium":0.0,"vulns_low":0.0,"vulns_unknown":0.0,"penalty":0.0},"findings":[],"evidence":[],"data":{"ecosystems":["PyPI"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":18.0,"findings":43.0,"findings_high":3.0,"findings_medium":0.0,"findings_low":40.0,"penalty":58.0},"findings":[{"rule_id":"zizmor/github-env","severity":"high","message":"dangerous use of environment file [confidence low]","path":".github/actions/upload-desktop-sentry/action.yml","line":17,"fingerprint":"github-env:.github/actions/upload-desktop-sentry/action.yml:17"},{"rule_id":"zizmor/dangerous-triggers","severity":"high","message":"use of fundamentally insecure workflow trigger [confidence medium]","path":".github/workflows/llm-triage.yml","line":5,"fingerprint":"dangerous-triggers:.github/workflows/llm-triage.yml:5"},{"rule_id":"zizmor/dangerous-triggers","severity":"high","message":"use of fundamentally insecure workflow trigger [confidence medium]","path":".github/workflows/reporter-labels.yml","line":3,"fingerprint":"dangerous-triggers:.github/workflows/reporter-labels.yml:3"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/actions/prepare-linux-webview/action.yml","line":14,"fingerprint":"self-repository:.github/actions/prepare-linux-webview/action.yml:14"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/build-android.yml","line":39,"fingerprint":"self-repository:.github/workflows/build-android.yml:39"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/build-android.yml","line":45,"fingerprint":"self-repository:.github/workflows/build-android.yml:45"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/build-desktop-native.yml","line":25,"fingerprint":"self-repository:.github/workflows/build-desktop-native.yml:25"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/build-desktop.yml","line":47,"fingerprint":"self-repository:.github/workflows/build-desktop.yml:47"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/build-desktop.yml","line":52,"fingerprint":"self-repository:.github/workflows/build-desktop.yml:52"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/build-desktop.yml","line":70,"fingerprint":"self-repository:.github/workflows/build-desktop.yml:70"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/build-desktop.yml","line":87,"fingerprint":"self-repository:.github/workflows/build-desktop.yml:87"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/build-desktop.yml","line":98,"fingerprint":"self-repository:.github/workflows/build-desktop.yml:98"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/build-ios.yml","line":33,"fingerprint":"self-repository:.github/workflows/build-ios.yml:33"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/build-ios.yml","line":39,"fingerprint":"self-repository:.github/workflows/build-ios.yml:39"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/release.yml","line":82,"fingerprint":"self-repository:.github/workflows/release.yml:82"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/release.yml","line":107,"fingerprint":"self-repository:.github/workflows/release.yml:107"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/release.yml","line":126,"fingerprint":"self-repository:.github/workflows/release.yml:126"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/release.yml","line":145,"fingerprint":"self-repository:.github/workflows/release.yml:145"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/release.yml","line":165,"fingerprint":"self-repository:.github/workflows/release.yml:165"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/release.yml","line":185,"fingerprint":"self-repository:.github/workflows/release.yml:185"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/release.yml","line":421,"fingerprint":"self-repository:.github/workflows/release.yml:421"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-android-build.yml","line":129,"fingerprint":"self-repository:.github/workflows/reusable-android-build.yml:129"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-android-build.yml","line":149,"fingerprint":"self-repository:.github/workflows/reusable-android-build.yml:149"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-desktop-linux.yml","line":71,"fingerprint":"self-repository:.github/workflows/reusable-desktop-linux.yml:71"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-desktop-linux.yml","line":80,"fingerprint":"self-repository:.github/workflows/reusable-desktop-linux.yml:80"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-desktop-linux.yml","line":85,"fingerprint":"self-repository:.github/workflows/reusable-desktop-linux.yml:85"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-desktop-linux.yml","line":107,"fingerprint":"self-repository:.github/workflows/reusable-desktop-linux.yml:107"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-desktop-macos.yml","line":96,"fingerprint":"self-repository:.github/workflows/reusable-desktop-macos.yml:96"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-desktop-macos.yml","line":105,"fingerprint":"self-repository:.github/workflows/reusable-desktop-macos.yml:105"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-desktop-macos.yml","line":169,"fingerprint":"self-repository:.github/workflows/reusable-desktop-macos.yml:169"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-desktop-native.yml","line":48,"fingerprint":"self-repository:.github/workflows/reusable-desktop-native.yml:48"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-desktop-native.yml","line":55,"fingerprint":"self-repository:.github/workflows/reusable-desktop-native.yml:55"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-desktop-native.yml","line":86,"fingerprint":"self-repository:.github/workflows/reusable-desktop-native.yml:86"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-desktop-verify.yml","line":54,"fingerprint":"self-repository:.github/workflows/reusable-desktop-verify.yml:54"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-desktop-verify.yml","line":80,"fingerprint":"self-repository:.github/workflows/reusable-desktop-verify.yml:80"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-desktop-windows.yml","line":95,"fingerprint":"self-repository:.github/workflows/reusable-desktop-windows.yml:95"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-desktop-windows.yml","line":104,"fingerprint":"self-repository:.github/workflows/reusable-desktop-windows.yml:104"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-desktop-windows.yml","line":127,"fingerprint":"self-repository:.github/workflows/reusable-desktop-windows.yml:127"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-desktop-windows.yml","line":203,"fingerprint":"self-repository:.github/workflows/reusable-desktop-windows.yml:203"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-ios-build.yml","line":83,"fingerprint":"self-repository:.github/workflows/reusable-ios-build.yml:83"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/reusable-ios-build.yml","line":177,"fingerprint":"self-repository:.github/workflows/reusable-ios-build.yml:177"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/verify-aur-package.yml","line":32,"fingerprint":"self-repository:.github/workflows/verify-aur-package.yml:32"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/verify-repository-checks.yml","line":32,"fingerprint":"self-repository:.github/workflows/verify-repository-checks.yml:32"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: SECURITY.md","ref":"SECURITY.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":2.0,"binary_assets":35.0,"suspicious":0.0},"findings":[],"evidence":[{"kind":"binary-release-asset","description":"release v14.0.0 ships metrolist-desktop-linux-arm64-14.0.0.AppImage (149 downloads)","ref":"metrolist-desktop-linux-arm64-14.0.0.AppImage","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v14.0.0/metrolist-desktop-linux-arm64-14.0.0.AppImage","weight":0.0},{"kind":"binary-release-asset","description":"release v14.0.0 ships metrolist-desktop-linux-x64-14.0.0.AppImage (489 downloads)","ref":"metrolist-desktop-linux-x64-14.0.0.AppImage","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v14.0.0/metrolist-desktop-linux-x64-14.0.0.AppImage","weight":0.0},{"kind":"binary-release-asset","description":"release v14.0.0 ships metrolist-desktop-macos-arm64-14.0.0.dmg (83 downloads)","ref":"metrolist-desktop-macos-arm64-14.0.0.dmg","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v14.0.0/metrolist-desktop-macos-arm64-14.0.0.dmg","weight":0.0},{"kind":"binary-release-asset","description":"release v14.0.0 ships metrolist-desktop-macos-x64-14.0.0.dmg (38 downloads)","ref":"metrolist-desktop-macos-x64-14.0.0.dmg","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v14.0.0/metrolist-desktop-macos-x64-14.0.0.dmg","weight":0.0},{"kind":"binary-release-asset","description":"release v14.0.0 ships metrolist-desktop-windows-arm64-14.0.0.zip (118 downloads)","ref":"metrolist-desktop-windows-arm64-14.0.0.zip","url":"https://github.com/MetrolistGroup/Metrolist/releases/download/v14.0.0/metrolist-desktop-windows-arm64-14.0.0.zip","weight":0.0},{"kind":"readme-download-lure","description":"links to file hosts or shorteners: t.me/","ref":"README.md","url":null,"weight":0.0},{"kind":"readme-download-lure","description":"links directly to a downloadable archive or installer","ref":"README.md","url":null,"weight":0.0}],"data":{"signals":["binary-release-assets","readme-download-lure"],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":18980.0,"function_nloc":309413.0,"mean_ccn":2.81,"p90_ccn":6.0,"complex_functions":329.0,"long_functions":233.0,"many_param_functions":222.0,"risky_nloc_share":0.1795},"findings":[],"evidence":[{"kind":"complex-function","description":"prepareAndPlay in androidApp/src/main/kotlin/com/metrolist/android/playback/ExoPlaybackPlayer.kt: complexity 161, 1038 lines","ref":"androidApp/src/main/kotlin/com/metrolist/android/playback/ExoPlaybackPlayer.kt","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/androidApp/src/main/kotlin/com/metrolist/android/playback/ExoPlaybackPlayer.kt#L2282","weight":1.0},{"kind":"complex-function","description":"leadingVowelFallback in shared/src/commonMain/kotlin/com/metrolist/shared/api/lyrics/romanizer/ThaiRomanizer.kt: complexity 142, 254 lines","ref":"shared/src/commonMain/kotlin/com/metrolist/shared/api/lyrics/romanizer/ThaiRomanizer.kt","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/shared/src/commonMain/kotlin/com/metrolist/shared/api/lyrics/romanizer/ThaiRomanizer.kt#L155","weight":1.0},{"kind":"complex-function","description":"updateByLookAhead in shared/src/commonMain/kotlin/com/metrolist/shared/ui/components/lyrics/LyricsRetiming.kt: complexity 132, 350 lines","ref":"shared/src/commonMain/kotlin/com/metrolist/shared/ui/components/lyrics/LyricsRetiming.kt","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/shared/src/commonMain/kotlin/com/metrolist/shared/ui/components/lyrics/LyricsRetiming.kt#L320","weight":1.0},{"kind":"complex-function","description":"BraccatoWordAnimation in shared/src/commonMain/kotlin/com/metrolist/shared/ui/components/lyrics/words/Braccato.kt: complexity 97, 582 lines","ref":"shared/src/commonMain/kotlin/com/metrolist/shared/ui/components/lyrics/words/Braccato.kt","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/shared/src/commonMain/kotlin/com/metrolist/shared/ui/components/lyrics/words/Braccato.kt#L317","weight":1.0},{"kind":"complex-function","description":"reduceDcPlayback in shared/src/commonMain/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectPlaybackReducer.kt: complexity 84, 174 lines","ref":"shared/src/commonMain/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectPlaybackReducer.kt","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/shared/src/commonMain/kotlin/com/metrolist/shared/deviceconnect/DeviceConnectPlaybackReducer.kt#L86","weight":1.0},{"kind":"complex-function","description":"handleBinary in shared/src/commonMain/kotlin/com/metrolist/shared/listentogether/ListenTogetherManager.kt: complexity 84, 208 lines","ref":"shared/src/commonMain/kotlin/com/metrolist/shared/listentogether/ListenTogetherManager.kt","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/shared/src/commonMain/kotlin/com/metrolist/shared/listentogether/ListenTogetherManager.kt#L1221","weight":1.0},{"kind":"complex-function","description":"toFullResolution in shared/src/commonMain/kotlin/com/metrolist/shared/api/lastfm/LastFM.kt: complexity 83, 728 lines","ref":"shared/src/commonMain/kotlin/com/metrolist/shared/api/lastfm/LastFM.kt","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/shared/src/commonMain/kotlin/com/metrolist/shared/api/lastfm/LastFM.kt#L149","weight":1.0},{"kind":"complex-function","description":"startUnsafe in shared/src/desktopMain/kotlin/com/metrolist/shared/playback/ffmpeg/FFmpegFrameGrabber.kt: complexity 79, 233 lines","ref":"shared/src/desktopMain/kotlin/com/metrolist/shared/playback/ffmpeg/FFmpegFrameGrabber.kt","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/shared/src/desktopMain/kotlin/com/metrolist/shared/playback/ffmpeg/FFmpegFrameGrabber.kt#L612","weight":1.0},{"kind":"complex-function","description":"YTGridItem in shared/src/commonMain/kotlin/com/metrolist/shared/ui/components/YTItemCards.kt: complexity 70, 280 lines","ref":"shared/src/commonMain/kotlin/com/metrolist/shared/ui/components/YTItemCards.kt","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/shared/src/commonMain/kotlin/com/metrolist/shared/ui/components/YTItemCards.kt#L452","weight":1.0},{"kind":"complex-function","description":"play in shared/src/desktopMain/kotlin/com/metrolist/shared/playback/ffmpeg/AudioPlayer.kt: complexity 69, 176 lines","ref":"shared/src/desktopMain/kotlin/com/metrolist/shared/playback/ffmpeg/AudioPlayer.kt","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/shared/src/desktopMain/kotlin/com/metrolist/shared/playback/ffmpeg/AudioPlayer.kt#L262","weight":1.0}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":338439.0,"duplicated_lines":28507.0,"duplicated_share":0.0842,"files":2248.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: androidApp/build.gradle.kts:151 and shared/build.gradle.kts:371","ref":"androidApp/build.gradle.kts","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/androidApp/build.gradle.kts#L151","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: androidApp/src/androidTest/kotlin/com/metrolist/android/playback/PreloadedPlaybackTest.kt:28 and androidApp/src/androidTest/kotlin/com/metrolist/android/playback/PreloadedPlaybackTest.kt:70","ref":"androidApp/src/androidTest/kotlin/com/metrolist/android/playback/PreloadedPlaybackTest.kt","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/androidApp/src/androidTest/kotlin/com/metrolist/android/playback/PreloadedPlaybackTest.kt#L28","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: androidApp/src/main/kotlin/com/metrolist/android/backup/BackupRestoreManager.kt:155 and desktopApp/src/jvmMain/kotlin/com/metrolist/desktop/backup/DesktopBackupRestoreManager.kt:90","ref":"androidApp/src/main/kotlin/com/metrolist/android/backup/BackupRestoreManager.kt","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/androidApp/src/main/kotlin/com/metrolist/android/backup/BackupRestoreManager.kt#L155","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: androidApp/src/main/kotlin/com/metrolist/android/backup/BackupRestoreManager.kt:372 and shared/src/jvmSharedMain/kotlin/com/metrolist/shared/backup/ForeignBackupArchive.kt:113","ref":"androidApp/src/main/kotlin/com/metrolist/android/backup/BackupRestoreManager.kt","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/androidApp/src/main/kotlin/com/metrolist/android/backup/BackupRestoreManager.kt#L372","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: androidApp/src/main/kotlin/com/metrolist/android/backup/BackupRestoreManager.kt:512 and shared/src/iosMain/kotlin/com/metrolist/shared/backup/IosBackupRestoreManager.kt:431","ref":"androidApp/src/main/kotlin/com/metrolist/android/backup/BackupRestoreManager.kt","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/androidApp/src/main/kotlin/com/metrolist/android/backup/BackupRestoreManager.kt#L512","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: androidApp/src/main/kotlin/com/metrolist/android/data/PlayHistoryRepository.kt:45 and desktopApp/src/jvmMain/kotlin/com/metrolist/desktop/history/HistoryRepository.kt:149","ref":"androidApp/src/main/kotlin/com/metrolist/android/data/PlayHistoryRepository.kt","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/androidApp/src/main/kotlin/com/metrolist/android/data/PlayHistoryRepository.kt#L45","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: androidApp/src/main/kotlin/com/metrolist/android/data/PlayHistoryRepository.kt:148 and androidApp/src/main/kotlin/com/metrolist/android/data/PlayHistoryRepository.kt:174","ref":"androidApp/src/main/kotlin/com/metrolist/android/data/PlayHistoryRepository.kt","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/androidApp/src/main/kotlin/com/metrolist/android/data/PlayHistoryRepository.kt#L148","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: androidApp/src/main/kotlin/com/metrolist/android/listentogether/AndroidListenTogetherManager.kt:196 and desktopApp/src/jvmMain/kotlin/com/metrolist/desktop/state/playback/ListenTogetherState.kt:95","ref":"androidApp/src/main/kotlin/com/metrolist/android/listentogether/AndroidListenTogetherManager.kt","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/androidApp/src/main/kotlin/com/metrolist/android/listentogether/AndroidListenTogetherManager.kt#L196","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: androidApp/src/main/kotlin/com/metrolist/android/listentogether/AndroidListenTogetherManager.kt:217 and shared/src/desktopTest/kotlin/com/metrolist/shared/listentogether/ListenTogetherManagerLifecycleTest.kt:1842","ref":"androidApp/src/main/kotlin/com/metrolist/android/listentogether/AndroidListenTogetherManager.kt","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/androidApp/src/main/kotlin/com/metrolist/android/listentogether/AndroidListenTogetherManager.kt#L217","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: androidApp/src/main/kotlin/com/metrolist/android/listentogether/ListenTogetherNotifications.kt:148 and androidApp/src/main/kotlin/com/metrolist/android/listentogether/ListenTogetherNotifications.kt:186","ref":"androidApp/src/main/kotlin/com/metrolist/android/listentogether/ListenTogetherNotifications.kt","url":"https://github.com/MetrolistGroup/Metrolist/blob/7d98d60dd317e703204ec58b35e72f26fffc3ee4/androidApp/src/main/kotlin/com/metrolist/android/listentogether/ListenTogetherNotifications.kt#L148","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":31.0,"weighted_findings":32.25,"scanned_lines":491842.0,"category:best-practice":13.0,"category:correctness":18.0},"findings":[{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/desktop-native-image/audio.py","line":31,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/desktop-native-image/audio.py:31"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/desktop-native-image/run.py","line":87,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/desktop-native-image/run.py:87"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/desktop-native-image/run.py","line":100,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/desktop-native-image/run.py:100"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/desktop-native-image/run.py","line":242,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/desktop-native-image/run.py:242"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/verify_linux_credentials.py","line":73,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/verify_linux_credentials.py:73"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/verify_linux_credentials.py","line":189,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/verify_linux_credentials.py:189"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"scripts/verify_linux_credentials.py","line":220,"fingerprint":"python.lang.best-practice.arbitrary-sleep:scripts/verify_linux_credentials.py:220"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"scripts/desktop-native-image/audio.py","line":34,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:scripts/desktop-native-image/audio.py:34"},{"rule_id":"opengrep/python.lang.best-practice.hardcoded-tmp-path","severity":"medium","message":"Detected hardcoded temp directory. Consider using 'tempfile.TemporaryFile' instead.","path":"scripts/desktop-native-image/benchmark.py","line":63,"fingerprint":"python.lang.best-practice.hardcoded-tmp-path:scripts/desktop-native-image/benchmark.py:63"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/desktop-native-image/benchmark.py","line":63,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/desktop-native-image/benchmark.py:63"},{"rule_id":"opengrep/python.lang.best-practice.hardcoded-tmp-path","severity":"medium","message":"Detected hardcoded temp directory. Consider using 'tempfile.TemporaryFile' instead.","path":"scripts/desktop-native-image/native_image.py","line":146,"fingerprint":"python.lang.best-practice.hardcoded-tmp-path:scripts/desktop-native-image/native_image.py:146"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/desktop-native-image/native_image.py","line":146,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/desktop-native-image/native_image.py:146"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/desktop-native-image/package.py","line":106,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/desktop-native-image/package.py:106"},{"rule_id":"opengrep/python.lang.best-practice.unspecified-open-encoding","severity":"medium","message":"Missing 'encoding' parameter. 'open()' uses device locale encodings by default, corrupting files with special characters. Specify the encoding to ensure cross-platform support when opening files in text mode (e.g. encoding=\"utf-8\").","path":"scripts/desktop-native-image/toolchain.py","line":84,"fingerprint":"python.lang.best-practice.unspecified-open-encoding:scripts/desktop-native-image/toolchain.py:84"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`const` is assigned twice; the first assignment is useless","path":".github/scripts/flatpak-paths.cjs","line":1,"fingerprint":"javascript.lang.correctness.useless-assignment:.github/scripts/flatpak-paths.cjs:1"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`base.array` is assigned twice; the first assignment is useless","path":"shared/src/iosMain/resources/kuromoji.js","line":5651,"fingerprint":"javascript.lang.correctness.useless-assignment:shared/src/iosMain/resources/kuromoji.js:5651"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`children_info[i++]` is assigned twice; the first assignment is useless","path":"shared/src/iosMain/resources/kuromoji.js","line":5899,"fingerprint":"javascript.lang.correctness.useless-assignment:shared/src/iosMain/resources/kuromoji.js:5899"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`children_info[i++]` is assigned twice; the first assignment is useless","path":"shared/src/iosMain/resources/kuromoji.js","line":5907,"fingerprint":"javascript.lang.correctness.useless-assignment:shared/src/iosMain/resources/kuromoji.js:5907"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`children_info[i++]` is assigned twice; the first assignment is useless","path":"shared/src/iosMain/resources/kuromoji.js","line":5909,"fingerprint":"javascript.lang.correctness.useless-assignment:shared/src/iosMain/resources/kuromoji.js:5909"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`bytes[j++]` is assigned twice; the first assignment is useless","path":"shared/src/iosMain/resources/kuromoji.js","line":6294,"fingerprint":"javascript.lang.correctness.useless-assignment:shared/src/iosMain/resources/kuromoji.js:6294"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`bytes[j++]` is assigned twice; the first assignment is useless","path":"shared/src/iosMain/resources/kuromoji.js","line":6299,"fingerprint":"javascript.lang.correctness.useless-assignment:shared/src/iosMain/resources/kuromoji.js:6299"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`bytes[j++]` is assigned twice; the first assignment is useless","path":"shared/src/iosMain/resources/kuromoji.js","line":6300,"fingerprint":"javascript.lang.correctness.useless-assignment:shared/src/iosMain/resources/kuromoji.js:6300"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`bytes[j++]` is assigned twice; the first assignment is useless","path":"shared/src/iosMain/resources/kuromoji.js","line":6305,"fingerprint":"javascript.lang.correctness.useless-assignment:shared/src/iosMain/resources/kuromoji.js:6305"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`bytes[j++]` is assigned twice; the first assignment is useless","path":"shared/src/iosMain/resources/kuromoji.js","line":6306,"fingerprint":"javascript.lang.correctness.useless-assignment:shared/src/iosMain/resources/kuromoji.js:6306"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`bytes[j++]` is assigned twice; the first assignment is useless","path":"shared/src/iosMain/resources/kuromoji.js","line":6307,"fingerprint":"javascript.lang.correctness.useless-assignment:shared/src/iosMain/resources/kuromoji.js:6307"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`bytes[j++]` is assigned twice; the first assignment is useless","path":"shared/src/iosMain/resources/kuromoji.js","line":8346,"fingerprint":"javascript.lang.correctness.useless-assignment:shared/src/iosMain/resources/kuromoji.js:8346"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`bytes[j++]` is assigned twice; the first assignment is useless","path":"shared/src/iosMain/resources/kuromoji.js","line":8351,"fingerprint":"javascript.lang.correctness.useless-assignment:shared/src/iosMain/resources/kuromoji.js:8351"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`bytes[j++]` is assigned twice; the first assignment is useless","path":"shared/src/iosMain/resources/kuromoji.js","line":8352,"fingerprint":"javascript.lang.correctness.useless-assignment:shared/src/iosMain/resources/kuromoji.js:8352"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`bytes[j++]` is assigned twice; the first assignment is useless","path":"shared/src/iosMain/resources/kuromoji.js","line":8357,"fingerprint":"javascript.lang.correctness.useless-assignment:shared/src/iosMain/resources/kuromoji.js:8357"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`bytes[j++]` is assigned twice; the first assignment is useless","path":"shared/src/iosMain/resources/kuromoji.js","line":8358,"fingerprint":"javascript.lang.correctness.useless-assignment:shared/src/iosMain/resources/kuromoji.js:8358"},{"rule_id":"opengrep/javascript.lang.correctness.useless-assignment","severity":"low","message":"`bytes[j++]` is assigned twice; the first assignment is useless","path":"shared/src/iosMain/resources/kuromoji.js","line":8359,"fingerprint":"javascript.lang.correctness.useless-assignment:shared/src/iosMain/resources/kuromoji.js:8359"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.1246,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":30643.0,"source_lines":492007.0,"test_ratio":0.0623,"ci_files":18.0,"cochange_share":0.25,"cochange_commits":4.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/build-android.yml","ref":".github/workflows/build-android.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/build-desktop-native.yml","ref":".github/workflows/build-desktop-native.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/build-desktop.yml","ref":".github/workflows/build-desktop.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/build-ios.yml","ref":".github/workflows/build-ios.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/llm-triage.yml","ref":".github/workflows/llm-triage.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/release.yml","ref":".github/workflows/release.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/reporter-labels.yml","ref":".github/workflows/reporter-labels.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/reusable-android-build.yml","ref":".github/workflows/reusable-android-build.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/reusable-desktop-linux.yml","ref":".github/workflows/reusable-desktop-linux.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/reusable-desktop-macos.yml","ref":".github/workflows/reusable-desktop-macos.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (go test, unittest)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (go vet, ktlint, shellcheck)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["go test","unittest"],"lint_commands":["go vet","ktlint","shellcheck"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":1.0,"readme_lines":256.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"docs/changelog.md","ref":"docs/changelog.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":1.0,"escapes":2.0,"escapes_per_kloc":0.623},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":1.0,"other_lines":331955.0,"files_blamed":1500.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":11.0,"quality:other_per_kloc":0.033,"security:ai_findings":0.0,"security:ai_per_kloc":0.0,"security:other_findings":38.0,"security:other_per_kloc":0.114},"findings":[],"evidence":[],"data":{"sampled":true,"comparable":false},"error":null}],"flags":[]}